The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Your software release may not support all of the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Application Visibility and Control (AVC) classifies applications using deep packet inspection techniques with the Network-Based Application Recognition (NBAR2) engine, and provides application-level visibility and control (QoS) in wired and wireless networks. After the applications are recognized, the AVC feature enables you to either drop, mark, or police the data traffic.
 Note |
Beginning in Cisco IOS XE Denali 16.2.1, support for AVC has been enabled on wired ports for standalone switches. |
NBAR2 can be activated either explicitly on the interface by enabling protocol-discovery or implicitly by attaching a QoS policy that contains match application classifier.
AVC is configured by defining a class map in a QoS client policy to match a protocol.
Note |
You can view list of 30 applications in Top Applications in Monitor Summary section of the UI. |
Traffic flows are analyzed and recognized using the NBAR2 engine at the access point. For more information about the NBAR2 Protocol Library, see http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/prot_lib/config_library/nbar-prot-pack-library.html. The specific flow is marked with the recognized protocol or application, such as WebEx. This per-flow information can be used for application visibility using Flexible NetFlow (FNF).
AVC QoS actions are applied with AVC filters in both upstream and downstream directions. The QoS actions supported for upstream flow are drop, mark, and police, and for downstream flow are mark and police. AVC QoS is applicable only when the application is classified correctly and matched with the class map filter in the policy map. For example, if the policy has a filter based on an application name, and the traffic has also been classified to the same application name, then the action specified for this match in the policy will be applied. For all QoS actions, refer Supported AVC Class Map and Policy Map Formats.
Protocol packs are a means to distribute protocol updates outside the switch software release trains, and can be loaded on the switch without replacing the switch software.
The Application Visibility and Control Protocol Pack (AVC Protocol Pack) is a single compressed file that contains multiple Protocol Description Language (PDL) files and a manifest file. A set of required protocols can be loaded, which helps AVC to recognize additional protocols for classification on your network. The manifest file gives information about the protocol pack, such as the protocol pack name, version, and some information about the available PDLs in the protocol pack.
The AVC Protocol Packs are released to specific AVC engine versions. You can load a protocol pack if the engine version on the switch platform is the same or higher than the version required by the protocol pack.
| Class Map Format | Class Map Example | Direction |
|---|---|---|
| match protocol protocol name |
|
Both upstream and downstream |
| match protocol attribute category category-name |
|
Both upstream and downstream |
| match protocol attribute sub-category sub-category-name |
|
Both upstream and downstream |
| match protocol attribute application-group application-group-name |
|
Both upstream and downstream |
| Combination filters |
|
Upstream only |
| Policy Format | QoS Action |
|---|---|
| Upstream client policy based on match protocol filter | Mark, police, and drop |
| Downstream client policy based on match protocol filter | Mark and police |
The following table describes the detailed AVC policy format with an example:
| AVC Policy Format | AVC Policy Example | Direction |
|---|---|---|
| Basic set |
|
Upstream and downstream |
| Basic police |
|
Upstream and downstream |
| Basic set and police |
|
Upstream and downstream |
| Multiple set and police including default |
|
Upstream and downstream |
| Hierarchical police |
|
Upstream and downstream |
| Hierarchical set and police |
|
|
| Drop action |
Any of the above examples apply to this format with this additional example: |
Upstream only |
Follow these guidelines to prevent clients from getting excluded due to malformed QoS policies:
When a new QoS policy is added to the device, a QoS policy with the same name should be added to other device within the same roam or mobility domain.
When a device is loaded with a software image of a later release, the new policy formats are supported. If you have upgraded the software image from an earlier release to a later release, you should save the configuration separately. When an earlier release image is loaded, some QoS policies might show as not supported, and you should restore those QoS policies to supported policy formats.
AVC is not supported on Cisco Aironet 702W, 702I (128 M memory), and 1530 Series Access Points.
Dropping or marking of the data traffic (control part) is not supported for software Release 3.3.
Dropping or marking of the data traffic (control part) is supported in software Release 3E.
Only the applications that are recognized with application visibility can be used for applying QoS control.
The template timeout cannot be modified on exporters configured with AVC. Even if the template timeout value is configured to a different value, only the default value of 600 seconds is used.
For the username information in the AVC-based record templates, ensure that you configure the options records to get the user MAC address to username mapping. For more information, refer Creating a Flow Exporter (Optional).
When there is a mix of AVC-enabled APs such as 3600, and non-AVC-enabled APs such as 1140, and the chosen policy for the client is AVC-enabled, the policy will not be sent to the APs that cannot support AVC.
Only ingress AVC statistics are supported. The frequency of statistics updates depends on the number of clients loaded at the AP at that time. Statistics are not supported for very large policy format sizes.
The total number of flows for which downstream AVC QoS supported per client is 1000.
The maximum number of flows supported for Catalyst 3850 Series Switch is 48 K.
AVC and non-AVC classes cannot be defined together in a policy in a downstream direction. For example, when you have a class map with match protocol, you cannot use any other type of match filter in the policy map in the downstream direction.
Drop action is not applicable for the downstream AVC QoS policy.
Match protocol is not supported in ingress or egress for SSID policy.
Google shares resources among several of their services because of which for some of the traffic it is not possible to say it is unique to one application. Therefore we added google-services for traffic that cannot be distinguished. The behavior you experience is expected.
By default, wireless avc basic (flow record) is available. When you click Apply from the GUI, then the record is mapped to the flow monitor.
Default flow record cannot be edited or deleted. If you require a new flow record, you need to create one and map it to the flow monitor from CLI.
| Command or Action | Purpose | |||
|---|---|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
||
| Step 2 |
flow record flow_record_name Example: |
Enters flow record configuration mode. |
||
| Step 3 |
description string Example: |
(Optional) Describes the flow record as a maximum 63-character string. |
||
| Step 4 |
match ipv4 protocol Example: |
Specifies a match to the IPv4 protocol. |
||
| Step 5 |
match ipv4 source address Example: |
Specifies a match to the IPv4 source address-based field. |
||
| Step 6 |
match ipv4 destination address Example: |
Specifies a match to the IPv4 destination address-based field. |
||
| Step 7 |
match transport source-port Example: |
Specifies a match to the transport layer source-port field. |
||
| Step 8 |
match transport destination-port Example: |
Specifies a match to the transport layer destination-port field. |
||
| Step 9 |
match flow direction Example: |
Specifies a match to the direction the flow was monitored in. |
||
| Step 10 |
match application name Example: |
Specifies a match to the application name.
|
||
| Step 11 |
match wireless ssid Example: |
Specifies a match to the SSID name identifying the wireless network. |
||
| Step 12 |
collect counter bytes long Example: |
Specifies to collect counter fields total bytes. |
||
| Step 13 |
collect counter packets long Example: |
Specifies to collect counter fields total packets. |
||
| Step 14 |
collect wireless ap mac address Example: |
Specifies to collect the BSSID with MAC addresses of the access points that the wireless client is associated with. |
||
| Step 15 |
collect wireless client mac address Example: |
|
||
| Step 16 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
You can create a flow export to define the export parameters for a flow. This is an optional procedure for configuring flow parameters.
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
| Step 2 |
flow exporter flow_exporter_name Example: |
Enters flow exporter configuration mode. |
| Step 3 |
description string Example: |
Describes the flow record as a maximum 63-character string. |
| Step 4 |
destination {hostname | ip-address} Example: |
Specifies the hostname or IPv4 address of the system to which the exporter sends data. |
| Step 5 |
transport udp port-value Example: |
Configures a port value for the UDP protocol. |
| Step 6 |
option application-table timeout seconds (optional) Example: |
(Optional) Specifies application table timeout option. The valid range is from 1 to 86400 seconds. |
| Step 7 |
option usermac-table timeout seconds (optional) Example: |
(Optional) Specifies wireless usermac-to-username table option. The valid range is from 1 to 86400 seconds. |
| Step 8 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
| Step 9 |
show flow exporter Example: |
Verifies your configuration. |
| Step 10 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
You can create a flow monitor and associate it with a flow record and a flow exporter.
| Command or Action | Purpose | |||
|---|---|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
||
| Step 2 |
flow monitor monitor-name Example: |
Creates a flow monitor and enters flow monitor configuration mode. |
||
| Step 3 |
description description Example: |
Creates a description for the flow monitor. |
||
| Step 4 |
record record-name Example: |
Specifies the name of a recorder that was created previously. |
||
| Step 5 |
exporter exporter-name Example: |
Specifies the name of an exporter that was created previously. |
||
| Step 6 |
cache timeout { active | inactive} (Optional) Example: |
Specifies to configure flow cache parameters. You can configure for a time period of 1 to 604800 seconds (optional).
|
||
| Step 7 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
||
| Step 8 |
show flow monitor Example: |
Verifies your configuration. |
Create a class map with match protocol filters.
Create a policy map.
Apply a policy map to the client in one of the following ways:
Apply a policy map over WLAN either from the CLI or GUI.
Apply a policy map through the AAA server (ACS server or ISE) from the CLI.
For more information, refer to the Cisco Identity Services Engine User Guide and Cisco Secure Access Control System User Guide.
Apply local policies either from the CLI or GUI.
You need to create a class map before configuring any match protocol filter. The QoS actions such as marking, policing, and dropping can be applied to the traffic. The AVC match protocol filters are applied only for the wireless clients. Refer 8.0 protocol pack for the protocols supported.
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
| Step 2 |
class-map class-map-name Example: |
Creates a class map. |
| Step 3 |
match protocol { application-name | attribute category category-name | attribute sub-category sub-category-name | attribute application-group application-group-name} Example: |
Specifies match to the application name, category name, subcategory name, or application group. |
| Step 4 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
| Command or Action | Purpose | |||
|---|---|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
||
| Step 2 |
policy-map policy-map-name Example: |
Creates a policy map by entering the policy map name, and enters policy-map configuration mode. By default, no policy maps are defined. The default behavior of a policy map is to set the DSCP to 0 if the packet is an IP packet and to set the CoS to 0 if the packet is tagged. No policing is performed.
|
||
| Step 3 |
class [class-map-name | class-default] Example: |
Defines a traffic classification, and enters policy-map class configuration mode. By default, no policy map and class maps are defined. If a traffic class has already been defined by using the class-map global configuration command, specify its name for class-map-name in this command. A class-default traffic class is predefined and can be added to any policy. It is always placed at the end of a policy map. With an implied match any is included in the class-default class, all packets that have not already matched the other traffic classes will match class-default .
|
||
| Step 4 |
police rate-bps burst-byte [exceed-action {drop | policed-dscp-transmit}] Example: |
Defines a policer for the classified traffic. By default, no policer is defined.
|
||
| Step 5 |
set { dscp new-dscp | cos cos-value} Example: |
Classifies IP traffic by setting a new value in the packet.
|
||
| Step 6 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
After creating your policy maps, attach the traffic policy or polices to an interface using the service-policy command.
Configuring Local Policies (CLI)
To configure local policies, complete these procedures:
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
| Step 2 |
service-template service-template-name Example: |
Enters service template configuration mode. |
| Step 3 |
access-group acl_list Example: |
Specifies the access list to be applied. |
| Step 4 |
vlan vlan_id Example: |
Specifies VLAN ID. You can specify a value from 1 to 4094. |
| Step 5 |
absolute-timer seconds Example: |
Specifies session timeout value for service template. You can specify a value from 1 to 65535. |
| Step 6 |
service-policy qos { input | output} Example: |
Configures QoS policies for the client. |
| Step 7 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
Parameter map is preferred to use than class map.
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
| Step 2 |
parameter-map type subscriber attribute-to-service parameter-map-name Example: |
Specifies the parameter map type and name. |
| Step 3 |
map-index map { device-type | mac-address | oui | user-role | username} { eq | not-eq | regex filter-name } Example: |
Specifies parameter map attribute filter criteria. |
| Step 4 |
interface-template interface-template-name Example: |
Enters service template configuration mode. |
| Step 5 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
| Step 2 |
policy-map type control subscriber policy-map-name Example: |
Specifies the policy map type. |
| Step 3 |
event identity-update { match-all | match-first} Example: |
Specifies match criteria to the policy map. |
| Step 4 |
class_number class { class_map_name | always } { do-all | do-until-failure | do-until-success} Example: |
|
| Step 5 |
action-index map attribute-to-service table parameter-map-name Example: |
Specifies parameter map table to be used. |
| Step 6 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
If the service policy contains any device type-based rules in the parameter map, ensure that the device classifier is already enabled.
Note |
You should use the device classification command to classify the device for it to be displayed correctly on the show command output. |
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
| Step 2 |
wlan wlan-name Example: |
Enters WLAN configuration mode. |
| Step 3 |
service-policy type control subscriber policymapname Example: |
Applies local policy to WLAN. |
| Step 4 |
profiling local http (optional) Example: |
Enables only profiling of devices based on HTTP protocol (optional). |
| Step 5 |
profiling radius http (optional) Example: |
Enables profiling of devices on ISE (optional). |
| Step 6 |
no shutdown Example: |
Specifies not to shut down the WLAN. |
| Step 7 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
| Step 2 |
wlan wlan-id Example: |
Enters WLAN configuration submode. For wlan-id, enter the WLAN ID. The range is 1 to 64. |
| Step 3 |
ip flow monitor monitor-name {input | output} Example: |
Associates a flow monitor to the WLAN for input or output packets. |
| Step 4 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
Monitoring Application Visibility and Control
This section describes the new commands for application visibility.
The following commands can be used to monitor application visibility on the and access points.
|
Command |
Purpose |
||
| show avc client client-mac top n application [ aggregate | upstream | downstream] |
Displays information about top "N" applications for the given client MAC. |
||
| show avc wlan ssid top n application [ aggregate | upstream | downstream] |
Displays information about top "N" applications for the given SSID. |
||
| avc top user[enable | disable] |
Enables or disables the information about top "N" application. |
||
| show avc wlan wlan-id application app name topN [ aggregate | upstream | downstream] |
Displays to know network usage information on a per user basis within an application.
|
||
| show wlan id wlan-id |
Displays information whether AVC is enabled or disabled on a particular WLAN. |
||
| show flow monitor flow_monitor_name cache |
Displays information about flow monitors. |
||
| show wireless client mac-address mac-address service-policy { input | output } |
Displays information about policy mapped to the wireless clients. |
||
| show ip nbar protocol-discovery[ interfaceinterface-type interface-number] [ stats{ byte-count | bit-rate | packet-count | max-bit-rate}] [ protocolprotocol-name | top-nnumber] |
Displays the statistics gathered by the NBAR Protocol Discovery feature.
|
||
|
show policy-map target show policy-map show policy-map policy-name show policy-map interfaceinterface-type interface-number |
Displays information about policy map. |
|
Command |
Purpose |
| clear avc client mac stats |
Clears the statistics per client. |
| clear avc wlan wlan-name stats |
Clears the statistics per WLAN. |
Examples: Application Visibility and Control
Device# configure terminal
Device(config)# flow record fr_v4
Device(config-flow-record)# match ipv4 protocol
Device(config-flow-record)# match ipv4 source address
Device(config-flow-record)# match ipv4 destination address
Device(config-flow-record)# match transport destination-port
Device(config-flow-record)# match flow direction
Device(config-flow-record)# match application name
Device(config-flow-record)# match wireless ssid
Device(config-flow-record)# collect counter bytes long
Device(config-flow-record)# collect counter packets long
Device(config-flow-record)# collect wireless ap mac address
Device(config-flow-record)# collect wireless client mac address
Device(config)#end
Device# configure terminal
Device# flow monitor fm_v4
Device(config-flow-monitor)# record fr_v4
Device(config-flow-monitor)# cache timeout active 1800
Device(config)#end
Device(config)#wlan wlan1
Device(config-wlan)#ip flow monitor fm_v4 input
Device(config-wlan)#ip flow mon fm-v4 output
Device(config)#end
Device# configure terminal
Device(config)# class-map cat-browsing
Device(config-cmap)# match protocol attribute category browsing
Device(config-cmap)#end
Device# configure terminal
Device(config)# class-map cat-fileshare
Device(config-cmap)# match protocol attribute category file-sharing
Device(config-cmap)#end
Device# configure terminal
Device(config)# class-map match-any subcat-terminal
Device(config-cmap)# match protocol attribute sub-category terminal
Device(config-cmap)#end
Device# configure terminal
Device(config)# class-map match-any webex-meeting
Device(config-cmap)# match protocol webex-meeting
Device(config-cmap)#end
This example shows how to create policy maps and define existing class maps for upstream QoS:
Device# configure terminal
Device(config)# policy-map test-avc-up
Device(config-pmap)# class cat-browsing
Device(config-pmap-c)# police 150000
Device(config-pmap-c)# set dscp 12
Device(config-pmap-c)#end
Device# configure terminal
Device(config)# policy-map test-avc-up
Device(config-pmap)# class cat-fileshare
Device(config-pmap-c)# police 1000000
Device(config-pmap-c)# set dscp 20
Device(config-pmap-c)#end
Device# configure terminal
Device(config)# policy-map test-avc-up
Device(config-pmap)# class subcat-terminal
Device(config-pmap-c)# police 120000
Device(config-pmap-c)# set dscp 15
Device(config-pmap-c)#end
Device# configure terminal
Device(config)# policy-map test-avc-up
Device(config-pmap)# class webex-meeting
Device(config-pmap-c)# police 50000000
Device(config-pmap-c)# set dscp 21
Device(config-pmap-c)#end
This example shows how to create policy maps and define existing class maps for downstream QoS:
Device# configure terminal
Device(config)# policy-map test-avc-down
Device(config-pmap)# class cat-browsing
Device(config-pmap-c)# police 200000
Device(config-pmap-c)# set dscp 10
Device(config-pmap-c)#end
Device# configure terminal
Device(config)# policy-map test-avc-up
Device(config-pmap)# class cat-fileshare
Device(config-pmap-c)# police 300000
Device(config-pmap-c)# set wlan user-priority 2
Device(config-pmap-c)# set dscp 20
Device(config-pmap-c)#end
Device# configure terminal
Device(config)# policy-map test-avc-up
Device(config-pmap)# class subcat-terminal
Device(config-pmap-c)# police 100000
Device(config-pmap-c)# set dscp 25
Device(config-pmap-c)#end
Device# configure terminal
Device(config)# policy-map test-avc-up
Device(config-pmap)# class webex-meeting
Device(config-pmap-c)# police 60000000
Device(config-pmap-c)# set dscp 41
Device(config-pmap-c)#end
This example shows how to apply defined QoS policy on a WLAN:
Device# configure terminal
Device(config)#wlan alpha
Device(config-wlan)#shut
Device(config-wlan)#end
Device(config-wlan)#service-policy client input test-avc-up
Device(config-wlan)#service-policy client output test-avc-down
Device(config-wlan)#no shut
Device(config-wlan)#end
The following example shows how to configure QoS attribute for a local profiling policy:
Device(config)# class-map type control subscriber match-all local_policy1_class
Device(config-filter-control-classmap)# match device-type android
Device(config)# service-template local_policy1_template
Device(config-service-template)# vlan 40
Device(config-service-template)# service-policy qos output local_policy1
Device(config)# policy-map type control subscriber local_policy1
Device(config-event-control-policymap)# event identity-update match-all
Device(config-class-control-policymap)# 1 class local_policy1_class do-until-success
Device(config-action-control-policymap)# 1 activate service-template local_policy1_template
Device(config)# wlan open_auth 9
Device(config-wlan)# client vlan VLAN40
Device(config-wlan)# service-policy type control subscriber local_policy1| Related Topic | Document Title |
|---|---|
| System management commands |
System Management Command Reference Guide, Cisco IOS XE Release 3SE (Cisco WLC 5700 Series) |
| Flexible NetFlow configuration |
Flexible NetFlow Configuration Guide, Cisco IOS XE Release 3SE (Cisco WLC 5700 Series) |
| Flexible NetFlow commands |
Flexible NetFlow Command Reference, Cisco IOS XE Release 3SE (Cisco WLC 5700 Series) |
| QoS configuration |
QoS Configuration Guide, Cisco IOS XE Release 3E (Cisco WLC 5700 Series) |
| QoS commands |
QoS Command Reference, Cisco IOS XE Release 3E (Cisco WLC 5700 Series) |
| Standard/RFC | Title |
|---|---|
| None |
— |
| MIB | MIBs Link |
|---|---|
| All supported MIBs for this release. |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
| Description | Link |
|---|---|
|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
| Release | Feature Information |
|---|---|
| Cisco IOS XE 3.3SE | This feature was introduced. |
|
Cisco IOS XE 3E |
AVC control with QoS was introduced. |
Feedback