2-243
Catalyst 2950 and Catalyst 2955 Switch Command Reference
OL-10102-01
Chapter 2 Catalyst 2950 and 2955 Cisco IOS Commands
policy-map
Only one policy map per interface per direction is supported. You can apply the same policy map to
multiple interfaces but only in the ingress direction.
If a policy map with a system-defined mask and a security access control list (ACL) with a user-defined
mask are configured on an interface, the switch might ignore the actions specified by the policy map and
perform only the actions specified by the ACL. For information about masks, see the “Understanding
Access Control Parameters” chapter in the software configuration guide for this release.
If a policy map with a user-defined mask and a security ACL with a user-defined mask are configured
on an interface, the switch takes one of the actions as described in Table 2-7.
Note For more information about configuring ACLs, see the “Configuring Network Security with ACLs”
chapter in the software configuration guide for this release.
Examples This example shows how to create a policy map called policy1. When attached to the ingress direction,
it matches all the incoming traffic defined in class1 and polices the traffic at an average rate of 1 Mbps
and bursts at 65536 bytes. Traffic exceeding the profile is dropped.
Switch(config)# policy-map policy1
Switch(config-pmap)# class class1
Switch(config-pmap-c)# police 1000000 65536 exceed-action drop
Switch(config-pmap-c)# exit
Switch(config-pmap)#
This example shows how to delete policymap2:
Switch(config)# no policy-map policymap2
You can verify your settings by entering the show policy-map privileged EXEC command.
Table 2-7 Interaction Between Policy Maps and Security ACLs
Policy-Map Conditions
Security-ACL
Conditions Action
When the packet is in profile. Permit specified
packets.
Traffic is forwarded.
When the packet is out of profile and the
out-of-profile action is to mark down the DSCP
value.
Drop specified
packets.
Traffic is dropped.
When the packet is out of profile and the
out-of-profile action is to drop the packet.
Permit specified
packets.
Traffic is dropped.
Drop specified
packets.
Traffic is dropped.