Policy

Policy configuration provides comprehensive traffic classification and action enforcement through class-maps and policy-maps that define how network traffic should be identified, prioritized, and processed based on various criteria including DSCP markings, protocols, and authentication states. It supports both Quality of Service (QoS) policies for bandwidth management, prioritization, and queuing, as well as control policies for network access control that define actions to take based on authentication events and user authorization status. Policy framework enables fine-grained traffic engineering, security enforcement, and service differentiation by combining flexible matching criteria with configurable actions such as rate limiting, priority queuing, and service template activation.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
policy	Class	`[policy]`	No

policy (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
class_maps	List	`[class_maps]`	No
policy_maps	List	`[policy_maps]`	No

class_maps (iosxe.devices.configuration.policy)

Name	Type	Constraint	Mandatory
name	String		Yes
type	Choice	`control`, `inspect`, `subscriber`	No
subscriber	Boolean	`true`, `false`	No
prematch	Choice	`match-all`, `match-any`, `match-none`	No
match	Class	`[match]`	No
description	String		No

policy_maps (iosxe.devices.configuration.policy)

Name	Type	Constraint	Mandatory
name	String		Yes
type	Choice	`access-control`, `appnav`, `control`, `epbr`, `inspect`, `ngsw-qos`, `packet-service`, `performance-monitor`, `queueing`, `service`, `service-chain`, `umbrella`	No
subscriber	Boolean	`true`, `false`	No
description	String		No
classes	List	`[classes]`	No
events	List	`[events]`	No

match (iosxe.devices.configuration.policy.class_maps)

Name	Type	Constraint	Mandatory
authorization_status_authorized	Boolean	`true`, `false`	No
authorization_status_unauthorized	Boolean	`true`, `false`	No
result_type_aaa_timeout	Boolean	`true`, `false`	No
result_type_success	Boolean	`true`, `false`	No
activated_service_templates	List	String	No
authorizing_method_priority_greater_than	List	Integer	No
method_dot1x	Boolean	`true`, `false`	No
result_type_method_dot1x_authoritative	Boolean	`true`, `false`	No
result_type_method_dot1x_agent_not_found	Boolean	`true`, `false`	No
result_type_method_dot1x_method_timeout	Boolean	`true`, `false`	No
method_mab	Boolean	`true`, `false`	No
result_type_method_mab_authoritative	Boolean	`true`, `false`	No
dscp	Any	List[Choice[`af11`, `af12`, `af13`, `af21`, `af22`, `af23`, `af31`, `af32`, `af33`, `af41`, `af42`, `af43`, `cs1`, `cs2`, `cs3`, `cs4`, `cs5`, `cs6`, `cs7`, `default`, `ef`]] or List[Integer[min: `0`, max: `63`]] or String[Regex: `^.[\$\%]\{.$`]	No
access_groups	List	Any[String or Integer]	No
access_groups_legacy	List	Any[String or Integer]	No
ip_dscp	List	Any[Choice[`af11`, `af12`, `af13`, `af21`, `af22`, `af23`, `af31`, `af32`, `af33`, `af41`, `af42`, `af43`, `cs1`, `cs2`, `cs3`, `cs4`, `cs5`, `cs6`, `cs7`, `default`, `dscp`, `ef`, `precedence`] or Integer[min: `0`, max: `63`]]	No
ip_precedence	List	Any[Choice[`critical`, `flash`, `flash-override`, `immediate`, `internet`, `network`, `priority`, `routine`] or Integer[min: `0`, max: `7`]]	No
protocols	List	String	No
class_maps	List	String	No

classes (iosxe.devices.configuration.policy.policy_maps)

Name	Type	Constraint	Mandatory
name	String		Yes
type	Choice	`inspect`	No
action	Choice	`drop`, `inspect`, `pass`	No
log	Boolean	`true`, `false`	No
parameter_map	String		No
actions	List	`[actions]`	No

events (iosxe.devices.configuration.policy.policy_maps)

Name	Type	Constraint	Mandatory
name	String		Yes
event_type	Choice	`aaa-available`, `absolute-timeout`, `agent-found`, `authentication-failure`, `authentication-success`, `authorization-failure`, `authorization-success`, `identity-update`, `inactivity-timeout`, `remote-authentication-failure`, `remote-authentication-success`, `remote-update`, `session-disconnected`, `session-started`, `tag-added`, `tag-removed`, `template-activated`, `template-activation-failed`, `template-deactivated`, `template-deactivation-failed`, `timer-expiry`, `violation`	No
match_type	Choice	`match-all`, `match-first`	No
classes	List	`[classes]`	No

actions (iosxe.devices.configuration.policy.policy_maps.classes)

Name	Type	Constraint	Mandatory
type	Choice	`bandwidth`, `compression`, `dbl`, `drop`, `estimate`, `fair-queue`, `forward`, `netflow-sampler`, `police`, `priority`, `queue-buffers`, `queue-limit`, `random-detect`, `service-policy`, `set`, `shape`, `trust`	No
bandwidth_bits	Integer	min: `1`, max: `100000000`	No
bandwidth_percent	Integer	min: `1`, max: `100`	No
bandwidth_remaining_option	Choice	`percent`, `ratio`	No
bandwidth_remaining_percent	Integer	min: `1`, max: `100`	No
bandwidth_remaining_ratio	Integer	min: `1`, max: `65536`	No
priority_level	Integer	min: `1`, max: `2`	No
priority_burst	Integer	min: `32`, max: `2000000`	No
queue_limit	Integer	min: `1`, max: `64000000`	No
queue_limit_type	Any	`bytes`, `ms`, `packets`, `us`	No
shape_average_bit_rate	Integer	min: `1000`, max: `100000000000`	No
shape_average_bits_per_interval_sustained	Integer	min: `32`, max: `800000000`	No
shape_average_bits_per_interval_excess	Integer	min: `0`, max: `154400000`	No
shape_average_percent	Integer	min: `0`, max: `100`	No
shape_average_burst_size_sustained	Integer	min: `10`, max: `2000`	No
shape_average_ms	Boolean	`true`, `false`	No
police_target_bitrate_conform_transmit	Boolean	`true`, `false`	No
police_target_bitrate_exceed_transmit	Boolean	`true`, `false`	No
police_target_bitrate	Integer	min: `1`, max: `100000000000`	No
police_target_bitrate_conform_burst_byte	Integer	min: `1`, max: `512000000`	No
police_target_bitrate_excess_burst_byte	Integer	min: `1`, max: `512000000`	No
police_target_bitrate_exceed_drop	Boolean	`true`, `false`	No
police_cir	Integer	min: `8000`, max: `100000000000`	No
police_bc	Integer	min: `1000`, max: `512000000`	No
police_be	Integer	min: `1000`, max: `512000000`	No
police_pir	Integer	min: `8000`, max: `64000000000`	No
police_pir_be	Integer	min: `1000`, max: `512000000`	No
police_cir_conform_transmit	Boolean	`true`, `false`	No
police_cir_exceed_drop	Boolean	`true`, `false`	No
police_rate_percent	Integer	min: `0`, max: `100`	No
queue_buffers_ratio	Integer	min: `0`, max: `100`	No
set_dscp	Any	Choice[`af11`, `af12`, `af13`, `af21`, `af22`, `af23`, `af31`, `af32`, `af33`, `af41`, `af42`, `af43`, `cs1`, `cs2`, `cs3`, `cs4`, `cs5`, `cs6`, `cs7`, `default`, `ef`] or Integer[min: `0`, max: `63`] or String[Regex: `^.[\$\%]\{.$`]	No
service_policy	String		No

classes (iosxe.devices.configuration.policy.policy_maps.events)

Name	Type	Constraint	Mandatory
number	Integer	min: `1`, max: `254`	Yes
class	String		Yes
execution_type	Choice	`do-all`, `do-until-failure`, `do-until-success`	No
actions	List	`[actions]`	No

actions (iosxe.devices.configuration.policy.policy_maps.events.classes)

Name	Type	Constraint	Mandatory
number	Integer	min: `1`, max: `254`	Yes
pause_reauthentication	Boolean	`true`, `false`	No
authorize	Boolean	`true`, `false`	No
terminate_config	Any	Choice[`dot1x`, `mab`, `webauth`] or String[Regex: `^.[\$\%]\{.$`] or String[Regex: `^.[\$\%]\{.$`]	No
activate_service_template_config_service_template	String		No
activate_service_template_config_aaa_list	String		No
activate_service_template_config_precedence	Integer	min: `1`, max: `254`	No
activate_service_template_config_replace_all	Boolean	`true`, `false`	No
activate_interface_template	String		No
activate_policy_type_control_subscriber	String		No
deactivate_interface_template	String		No
deactivate_service_template	String		No
deactivate_policy_type_control_subscriber	String		No
authenticate_using_method	Choice	`dot1x`, `mab`, `webauth`	No
authenticate_using_retries	Integer	min: `1`, max: `5`	No
authenticate_using_retry_time	Integer	min: `0`, max: `65535`	No
authenticate_using_priority	Integer	min: `1`, max: `254`	No
authenticate_using_aaa_config	Boolean	`true`, `false`	No
authenticate_using_authc_list	String		No
authenticate_using_authz_list	String		No
authenticate_using_aaa_authc_list_legacy	String		No
authenticate_using_aaa_authz_list_legacy	String		No
authenticate_using_both	Boolean	`true`, `false`	No
authenticate_using_parameter_map	String		No
replace	Boolean	`true`, `false`	No
restrict	Boolean	`true`, `false`	No
clear_session	Boolean	`true`, `false`	No
clear_authenticated_data_hosts_on_port	Boolean	`true`, `false`	No
protect	Boolean	`true`, `false`	No
err_disable	Boolean	`true`, `false`	No
resume_reauthentication	Boolean	`true`, `false`	No
authentication_restart	Integer	min: `1`, max: `65535`	No
set_domain	Choice	`data`, `switch`, `voice`	No
unauthorize	Boolean	`true`, `false`	No
notify	Boolean	`true`, `false`	No
set_timer_name	String		No
set_timer_value	Integer	min: `0`, max: `65535`	No
map_attribute_to_service_table	String		No

By defining class-maps and policy-maps, policy configuration enables granular traffic classification, prioritization, and enforcement for QoS and access control.

Policy Parameters

Key Components:

Class-Map Name (class_maps.name): The identifier for the class-map.
Class-Map Type (class_maps.type): Specifies the class-map type (QoS, control, inspect).
Class-Map Match Criteria (class_maps.match): Defines match conditions (DSCP, protocol, access-groups, authorization status, authentication methods including dot1x and mab). Match criteria that accept multiple values use list format (e.g., dscp, access_groups, ip_dscp, ip_precedence, authorizing_method_priority_greater_than).
Access Groups (class_maps.match.access_groups, class_maps.match.access_groups_legacy): Both attributes accept named ACLs (strings) and numbered ACLs (integers, 1-199 or 1300-2699) in a single list. If your list contains only named ACLs, use access_groups regardless of IOS-XE version — the _legacy distinction only applies when numbered ACLs are included. When numbered ACLs are present:
- IOS-XE 17.18 and later: Use access_groups. Supports multiple numbered ACLs per class-map.
- IOS-XE 17.15.x and earlier: Use access_groups_legacy. Supports only one numbered ACL per class-map (additional numbered ACLs require separate class-maps).
Policy-Map Name (policy_maps.name): The identifier for the policy-map.
Policy-Map Type (policy_maps.type): Specifies the policy-map type (QoS, control, inspect, ngsw-qos).
Policy-Map Classes (policy_maps.classes): Associates classes with the policy-map.
Policy-Map Actions (policy_maps.classes.actions): Specifies actions for matched traffic. The type field determines which action attributes apply:
- bandwidth: Bandwidth allocation (bandwidth_percent, bandwidth_remaining_option, bandwidth_remaining_ratio, bandwidth_remaining_percent).
- priority: Priority queuing (priority_level, priority_burst).
- shape: Traffic shaping (shape_average_percent).
- police: CIR/PIR dual-rate policing (police_cir, police_bc, police_be, police_pir, police_pir_be, police_cir_conform_transmit, police_cir_exceed_drop).
- police-target-bitrate: Target bitrate policing (police_target_bitrate, police_target_bitrate_conform_burst_byte, police_target_bitrate_excess_burst_byte, police_target_bitrate_conform_transmit, police_target_bitrate_exceed_drop).
- police-rate-percent: Rate-based policing as a percentage (police_rate_percent).
- queue-limit: Queue depth (queue_limit, queue_limit_type).
- queue-buffers: Queue buffer ratio (queue_buffers_ratio). Platform-specific (Cat9K).
- set: DSCP marking (set_dscp). Accepts named values (e.g., ef, af11) or numeric 0-63.
- service-policy: Attach a child service-policy for hierarchical QoS (service_policy).
Events (policy_maps.events): Defines events for control policies (authentication-success, authentication-failure, violation, session-disconnected, etc.).
Description (description): Descriptive text for class-maps and policy-maps.

Sample Configuration

The following configuration describes how to set up QoS and control policies on a Cisco IOS-XE device, including class-maps for DSCP values and authentication status, and policy-maps for QoS actions and access control.

class-map match-all VOICE-CLASS
 description Voice traffic classification
 match dscp 46
!
class-map match-all VIDEO-CLASS
 description Video traffic classification
 match dscp 34 36 38
!
class-map match-all DATA-CLASS
 description Data traffic classification for policing
 match dscp af31
!
class-map match-any PRIORITY-TRAFFIC
 description Multiple match criteria example
 match access-group 100
 match access-group name ACL_VOICE ACL_VIDEO
 match ip precedence 5 critical
 match ip dscp ef cs5
!
class-map type control subscriber CONTROL-CLASS
 match authorization-status authorized
 match method dot1x
 match result-type method dot1x authoritative
 match authorizing-method-priority greater-than 10 20
 match method mab
 match result-type method mab authoritative
!
class-map type control subscriber match-all AUTHC_SUCCESS-AUTHZ_FAIL
 match result-type success
 match authorization-status unauthorized
!
class-map type control subscriber match-any AAA-SVR-DOWN-UNAUTHD-HOST
 description Class-map for pause reauthentication example
!
policy-map WAN-QOS-POLICY
 description WAN QoS policy with voice and video prioritization
 class VOICE-CLASS
  priority level 1
  priority-burst 8000
 class VIDEO-CLASS
  bandwidth percent 30
  queue-limit 64 packets
 class DATA-CLASS
 class class-default
  bandwidth remaining ratio 10
  police 10000000 50000
!
policy-map type control subscriber ACCESS-CONTROL-POLICY
 description Network access control policy with pause reauthentication
 event authentication-failure match-all
  10 class AAA-SVR-DOWN-UNAUTHD-HOST do-until-failure
   10 pause reauthentication
!
policy-map type control subscriber VIOLATION-POLICY
 description Policy-map for handling violations with port restriction
 event violation match-all
  10 class always do-until-failure
   10 restrict
!
class-map type control subscriber match-any TIMER-CLASS
 description Class-map for timer example
!
policy-map type control subscriber TIMER-POLICY
 description Policy-map with timer actions
 event authentication-success match-all
  10 class TIMER-CLASS do-until-failure
   10 set-timer TIMER1 value 3600
!
policy-map type control subscriber SESSION-CLEANUP-POLICY
 description Policy-map for session cleanup on disconnect
 event session-disconnected match-first
  1 class always do-all
   1 deactivate policy type control subscriber ACCESS-CONTROL-POLICY

Example YAML Code

The following YAML code defines QoS and control policies on an IOS-XE device, specifying class-maps with match criteria and policy-maps with actions and events.

iosxe:
  devices:
    - name: Device1
      configuration:
        policy:
          class_maps:
            - name: VOICE-CLASS
              prematch: match-all
              description: Voice traffic classification
              match:
                dscp: [46]
            - name: VIDEO-CLASS
              prematch: match-all
              description: Video traffic classification
              match:
                dscp: [34, 36, 38]
            - name: DATA-CLASS
              prematch: match-all
              description: Data traffic classification for policing
              match:
                dscp: [af31]
            - name: PRIORITY-TRAFFIC
              prematch: match-any
              description: Multiple match criteria example (pre-17.18)
              match:
                access_groups_legacy: [100, ACL_VOICE, ACL_VIDEO]
                ip_precedence: [5, critical]
                ip_dscp: [ef, cs5]
            - name: PRIORITY-TRAFFIC-V2
              prematch: match-any
              description: Multiple match criteria example (17.18+)
              match:
                access_groups: [100, 150, ACL_VOICE, ACL_VIDEO]
                ip_precedence: [5, critical]
                ip_dscp: [ef, cs5]
            - name: IP-DSCP-CLASS
              prematch: match-any
              description: Match traffic based on IP DSCP values
              match:
                ip_dscp: [af41, af42, ef]
            - name: IP-PRECEDENCE-CLASS
              prematch: match-any
              description: Match traffic based on IP precedence
              match:
                ip_precedence: [critical, network]
            - name: CONTROL-CLASS
              type: control
              subscriber: true
              match:
                authorization_status_authorized: true
                method_dot1x: true
                result_type_method_dot1x_authoritative: true
                authorizing_method_priority_greater_than: [10, 20]
                method_mab: true
                result_type_method_mab_authoritative: true
            - name: AUTHC_SUCCESS-AUTHZ_FAIL
              type: control
              subscriber: true
              prematch: match-all
              match:
                result_type_success: true
                authorization_status_unauthorized: true
            - name: AAA-SVR-DOWN-UNAUTHD-HOST
              type: control
              subscriber: true
              prematch: match-any
              description: Class-map for pause reauthentication example
            - name: TIMER-CLASS
              type: control
              subscriber: true
              prematch: match-any
              description: Class-map for timer example
          policy_maps:
            - name: WAN-QOS-POLICY
              description: WAN QoS policy with voice and video prioritization
              classes:
                - name: VOICE-CLASS
                  actions:
                    - type: priority
                      priority_level: 1
                      priority_burst: 8000
                - name: VIDEO-CLASS
                  actions:
                    - type: bandwidth
                      bandwidth_percent: 30
                - name: class-default
                  actions:
                    - type: bandwidth
                      bandwidth_remaining_option: ratio
                      bandwidth_remaining_ratio: 10
                    - type: queue-limit
                      queue_limit: 64
                      queue_limit_type: packets
                - name: DATA-CLASS
                  actions:
                    - type: police-target-bitrate
                      police_target_bitrate: 10000000
                      police_target_bitrate_conform_burst_byte: 50000
            - name: ACCESS-CONTROL-POLICY
              type: control
              subscriber: true
              description: Network access control policy with pause reauthentication
              events:
                - name: authentication-failure
                  event_type: authentication-failure
                  match_type: match-all
                  classes:
                    - number: 10
                      class: AAA-SVR-DOWN-UNAUTHD-HOST
                      execution_type: do-until-failure
                      actions:
                        - number: 10
                          pause_reauthentication: true
            - name: VIOLATION-POLICY
              type: control
              subscriber: true
              description: Policy-map for handling violations with port restriction
              events:
                - name: violation
                  event_type: violation
                  match_type: match-all
                  classes:
                    - number: 10
                      class: always
                      execution_type: do-until-failure
                      actions:
                        - number: 10
                          restrict: true
            - name: TIMER-POLICY
              type: control
              subscriber: true
              description: Policy-map with timer actions
              events:
                - name: authentication-success
                  event_type: authentication-success
                  match_type: match-all
                  classes:
                    - number: 10
                      class: TIMER-CLASS
                      execution_type: do-until-failure
                      actions:
                        - number: 10
                          set_timer_name: TIMER1
                          set_timer_value: 3600
            - name: SESSION-CLEANUP-POLICY
              type: control
              subscriber: true
              description: Policy-map for session cleanup on disconnect
              events:
                - name: session-disconnected
                  event_type: session-disconnected
                  match_type: match-first
                  classes:
                    - number: 1
                      class: always
                      execution_type: do-all
                      actions:
                        - number: 1
                          deactivate_policy_type_control_subscriber: ACCESS-CONTROL-POLICY

Advanced QoS Policy Examples

CIR/PIR Dual-Rate Policing with Conform/Exceed Actions

policy-map WAN-INGRESS-POLICE
 class CM_VIDEO
  police cir 10000000 bc 312500
   conform-action transmit
   exceed-action drop
  police pir 15000000 be 312500

iosxe:
  devices:
    - name: WAN-Router
      configuration:
        policy:
          policy_maps:
            - name: WAN-INGRESS-POLICE
              classes:
                - name: CM_VIDEO
                  actions:
                    - type: police
                      police_cir: 10000000
                      police_bc: 312500
                      police_pir: 15000000
                      police_pir_be: 312500
                      police_cir_conform_transmit: true
                      police_cir_exceed_drop: true

Rate Percent Policing

policy-map RATE-LIMIT-POLICY
 class class-default
  police rate percent 50

iosxe:
  devices:
    - name: WAN-Router
      configuration:
        policy:
          policy_maps:
            - name: RATE-LIMIT-POLICY
              classes:
                - name: class-default
                  actions:
                    - type: police
                      police_rate_percent: 50

Queue Buffers Ratio (Cat9K)

policy-map QUEUING-POLICY
 class CM_VIDEO
  bandwidth remaining percent 30
  queue-buffers ratio 25

iosxe:
  devices:
    - name: Cat9K-Switch
      configuration:
        policy:
          policy_maps:
            - name: QUEUING-POLICY
              classes:
                - name: CM_VIDEO
                  actions:
                    - type: bandwidth
                      bandwidth_remaining_option: percent
                      bandwidth_remaining_percent: 30
                    - type: queue-buffers
                      queue_buffers_ratio: 25

Set DSCP Marking

policy-map MARK-POLICY
 class CM_BULK
  set dscp af11

iosxe:
  devices:
    - name: WAN-Router
      configuration:
        policy:
          policy_maps:
            - name: MARK-POLICY
              classes:
                - name: CM_BULK
                  actions:
                    - type: set
                      set_dscp: af11

Hierarchical QoS with Child Service-Policy

policy-map CHILD-QOS
 class VOICE-CLASS
  priority level 1
 class VIDEO-CLASS
  bandwidth percent 30
!
policy-map PARENT-SHAPE
 class class-default
  shape average 20000000
  service-policy CHILD-QOS

iosxe:
  devices:
    - name: WAN-Router
      configuration:
        policy:
          policy_maps:
            - name: CHILD-QOS
              classes:
                - name: VOICE-CLASS
                  actions:
                    - type: priority
                      priority_level: 1
                - name: VIDEO-CLASS
                  actions:
                    - type: bandwidth
                      bandwidth_percent: 30
            - name: PARENT-SHAPE
              classes:
                - name: class-default
                  actions:
                    - type: shape
                      shape_average_bit_rate: 20000000
                    - type: service-policy
                      service_policy: CHILD-QOS

Traffic Shaping with Shape Average Percent

policy-map SHAPE-POLICY
 class class-default
  shape average percent 80

iosxe:
  devices:
    - name: WAN-Router
      configuration:
        policy:
          policy_maps:
            - name: SHAPE-POLICY
              classes:
                - name: class-default
                  actions:
                    - type: shape
                      shape_average_percent: 80

Combined Egress QoS Policy

policy-map WAN-EGRESS-QOS
 description WAN egress shaping and queuing policy
 class CM_VOICE
  priority level 1
  priority-burst 8000
 class CM_VIDEO
  bandwidth remaining percent 30
  queue-buffers ratio 25
 class CM_CRITICAL
  bandwidth remaining percent 20
 class class-default
  bandwidth remaining percent 25
  shape average percent 80

iosxe:
  devices:
    - name: WAN-Router
      configuration:
        policy:
          class_maps:
            - name: CM_VOICE
              prematch: match-any
              match:
                ip_dscp: [ef]
            - name: CM_VIDEO
              prematch: match-any
              match:
                ip_dscp: [af41, af42, af43]
            - name: CM_CRITICAL
              prematch: match-any
              match:
                ip_dscp: [cs6, cs7]
            - name: CM_BULK
              prematch: match-any
              match:
                ip_dscp: [af11, af12, af13]
          policy_maps:
            - name: WAN-EGRESS-QOS
              description: WAN egress shaping and queuing policy
              classes:
                - name: CM_VOICE
                  actions:
                    - type: priority
                      priority_level: 1
                      priority_burst: 8000
                - name: CM_VIDEO
                  actions:
                    - type: bandwidth
                      bandwidth_remaining_option: percent
                      bandwidth_remaining_percent: 30
                    - type: queue-buffers
                      queue_buffers_ratio: 25
                - name: CM_CRITICAL
                  actions:
                    - type: bandwidth
                      bandwidth_remaining_option: percent
                      bandwidth_remaining_percent: 20
                - name: class-default
                  actions:
                    - type: bandwidth
                      bandwidth_remaining_option: percent
                      bandwidth_remaining_percent: 25
                    - type: shape
                      shape_average_percent: 80

Zone-Based Firewall (ZBF) Inspect Class-Map Examples

Basic Inspect Class-Map with Protocol and ACL Matching

class-map type inspect match-any CM_INSPECT_TRAFFIC
 description Inspect allowed traffic
 match access-group name ACL_ALLOWED
 match protocol tcp
 match protocol udp
!
class-map type inspect match-all CM_INSPECT_STRICT
 match access-group name ACL_STRICT
 match protocol https

iosxe:
  devices:
    - name: Router1
      configuration:
        policy:
          class_maps:
            - name: CM_INSPECT_TRAFFIC
              type: inspect
              prematch: match-any
              description: Inspect allowed traffic
              match:
                access_groups:
                  - ACL_ALLOWED
                protocols:
                  - tcp
                  - udp
            - name: CM_INSPECT_STRICT
              type: inspect
              prematch: match-all
              match:
                access_groups:
                  - ACL_STRICT
                protocols:
                  - https

Nested Inspect Class-Map References

class-map type inspect match-any CM_ALLOWED_PROTOCOLS
 match protocol tcp
 match protocol udp
!
class-map type inspect match-all CM_FILTERED_TRAFFIC
 match class-map CM_ALLOWED_PROTOCOLS
 match access-group name ACL_INTERNAL

iosxe:
  devices:
    - name: Router1
      configuration:
        policy:
          class_maps:
            - name: CM_ALLOWED_PROTOCOLS
              type: inspect
              prematch: match-any
              match:
                protocols:
                  - tcp
                  - udp
            - name: CM_FILTERED_TRAFFIC
              type: inspect
              prematch: match-all
              match:
                class_maps:
                  - CM_ALLOWED_PROTOCOLS
                access_groups:
                  - ACL_INTERNAL

Zone-Based Firewall (ZBF) Inspect Policy-Maps

Policy-maps of type: inspect are used with Zone-Based Firewall (ZBF) to define what actions to take on traffic matched by class-maps. Each class within an inspect policy-map specifies one of three actions: pass, drop, or inspect.

Actions

Action	Description
`pass`	Allow the traffic without stateful inspection
`pass` + `log: true`	Allow the traffic and generate a syslog message
`drop`	Silently drop the traffic
`drop` + `log: true`	Drop the traffic and generate a syslog message
`inspect`	Enable stateful deep packet inspection
`inspect` + `parameter_map`	Inspect with a custom parameter-map for tuning

CLI Mapping

YAML Attribute	CLI Command
`type: inspect` (policy-map)	`policy-map type inspect <name>`
`type: inspect` (class)	`class type inspect <name>`
`name: class-default`	`class class-default`
`action: pass`	`pass`
`action: pass` + `log: true`	`pass log`
`action: drop`	`drop`
`action: drop` + `log: true`	`drop log`
`action: inspect`	`inspect`
`action: inspect` + `parameter_map: <name>`	`inspect <name>`

Example

iosxe:
  devices:
    - name: router1
      url: https://10.0.0.1
      configuration:
        policy:
          class_maps:
            - name: CM_WEB_TRAFFIC
              type: inspect
              prematch: match-any
              match:
                access_groups:
                  - ACL_WEB
            - name: CM_BLOCKED
              type: inspect
              prematch: match-any
              match:
                access_groups:
                  - ACL_DENY
          policy_maps:
            - name: PM_INSIDE_TO_OUTSIDE
              type: inspect
              classes:
                - name: CM_WEB_TRAFFIC
                  type: inspect
                  action: inspect
                - name: CM_BLOCKED
                  type: inspect
                  action: drop
                  log: true
                - name: class-default
                  action: drop

The above YAML produces the following CLI configuration:

policy-map type inspect PM_INSIDE_TO_OUTSIDE
 class type inspect CM_WEB_TRAFFIC
  inspect
 class type inspect CM_BLOCKED
  drop log
 class class-default
  drop

Limitations

Unsupported Police Actions

The following police action commands are not currently supported due to missing table-map resource support in the Terraform provider:

CLI Command	Description
`exceed-action set-dscp-transmit dscp table <TABLE>`	Set DSCP using table-map when exceeding CIR
`violate-action set-dscp-transmit dscp table <TABLE>`	Set DSCP using table-map when violating PIR

These commands require a table-map configuration that maps input DSCP values to output DSCP values. The YANG models support these features, but the Terraform provider does not currently implement the table-map resource or the corresponding police action attributes (exceed-set-dscp-transmit-table, violate-set-dscp-transmit).

AAA Method List Attributes (Policy-Map Event Actions)

The AAA authentication/authorization method list attributes for policy-map event actions have version-specific variants:

IOS-XE Version	Attributes	YANG Path
17.18+	`authenticate_using_aaa_config`, `authenticate_using_authc_list`, `authenticate_using_authz_list`	`authenticate/using/aaa-config`, `authenticate/using/authc-list`, `authenticate/using/authz-list`
Before 17.18	`authenticate_using_aaa_authc_list_legacy`, `authenticate_using_aaa_authz_list_legacy`	`authenticate/using/aaa/authc-list`, `authenticate/using/aaa/authz-list`

When using the 17.18+ attributes, authenticate_using_aaa_config: true is required — it satisfies a YANG when constraint that gates the authc-list and authz-list leaves.

Both variants produce the same CLI output:

policy-map type control subscriber DOT1X_POLICY
 event session-started match-all
  10 class always do-until-failure
   10 authenticate using dot1x aaa authc-list MY_AUTHC_LIST authz-list MY_AUTHZ_LIST

17.18+ data model:

actions:
  - number: 10
    authenticate_using_method: dot1x
    authenticate_using_aaa_config: true
    authenticate_using_authc_list: MY_AUTHC_LIST
    authenticate_using_authz_list: MY_AUTHZ_LIST

Pre-17.18 data model:

actions:
  - number: 10
    authenticate_using_method: dot1x
    authenticate_using_aaa_authc_list_legacy: MY_AUTHC_LIST
    authenticate_using_aaa_authz_list_legacy: MY_AUTHZ_LIST

Version-Specific Features

Feature	IOS-XE 17.12.x	IOS-XE 17.15.x	IOS-XE 17.18.x
`ngsw-qos` policy-map type	Not Available	Available	Available
`queueing` policy-map type	Available	Available	Available
`queue-buffers ratio`	Available (Cat9K)	Available (Cat9K)	Available (Cat9K)
`authenticate_using_authc_list` / `authenticate_using_authz_list`	Not Available	Not Available	Available
`authenticate_using_aaa_authc_list_legacy` / `authenticate_using_aaa_authz_list_legacy`	Available	Available	Available (deprecated)

The ngsw-qos (Next-Gen Switch QoS) policy-map type is only available on Catalyst 9000 switches running IOS-XE 17.15.x or later. The queue-buffers ratio action is platform-specific and primarily available on Catalyst 9000 series switches.