Usage Guidelines

The holddown command is entered on a master controller. This command is used to configure the prefix route dampening timer to set the minimum period of time for which a new exit must be used before an alternate exit can be selected. The master controller puts a prefix in a hold-down state during an exit change to isolate the prefix during the transition period to prevent the prefix from flapping because of rapid state changes. PfR does not implement policy changes while a prefix is in the hold-down state. A prefix will remain in a hold-down state for the default or configured time period. When the hold-down timer expires, PfR will select the best exit based on performance and policy configuration. However, an immediate route change will be triggered if the current exit for a prefix becomes unreachable.

Configuring a new timer value will immediately replace the existing value if the new value is less than the amount of the time remaining. If the new value is greater than the amount of the time remaining, the new timer value will be used when the existing timer is reset.

Usage Guidelines

The PfR application interface defines the mode of communication and messaging between applications and the network for the purpose of optimizing the traffic associated with the applications. A provider is defined as an entity outside the network in which the router configured as a PfR master controller exists, for example, an ISP or a branch office of the same company. The provider has one or more host devices running one or more applications that use the PfR application interface to communicate with a PfR master controller. A provider must be registered with a PfR master controller before an application on a host device can interface with PfR. Use the api provider (PfR) command to register the provider, and use the host-address (PfR) command to configure a host device. After registration, a host device in the provider network can initiate a session with a PfR master controller. The PfR application interface provides an automated method for networks to be aware of applications and provides application-aware performance routing.

Use the optional priority keyword to specify a priority value for the host device when multiple host devices are configured. The number 1 assigns the highest priority to any requests from the host device. If you assign a priority, each host device must be assigned a different priority number. If you try to assign the same priority number to two different host devices, an error message is displayed on the console.

Usage Guidelines

Use this command for the branch master controller configuration.

Usage Guidelines

This command is used to implement PfR Border Gateway Protocol (BGP) inbound optimization by identifying the prefixes within a network (inside prefixes). PfR BGP inbound optimization supports best entrance selection for traffic that originates from prefixes outside an autonomous system destined for prefixes inside the autonomous system. External BGP (eBGP) advertisements from an autonomous system to another autonomous system (for example, an Internet service provider [ISP]) can influence the entrance path for traffic entering the network. PfR uses eBGP advertisements to manipulate the best entrance selection.

Usage Guidelines

The interface command is entered on a master controller. This command is used to configure external and internal interfaces on border routers to be under PfR control. External interfaces are configured as PfR managed exit links to forward traffic. External interfaces are used by the master controller to actively monitor prefix and link performance. Internal interfaces are used only for passive performance monitoring with NetFlow.

At least one external and one internal interface must be configured on each border router to allow NetFlow to monitor inbound and outbound traffic. At least two external interfaces are required in a PfR-managed network. You can configure a maximum of 20 external interfaces for a single master controller in a PfR-managed network. Loopback interfaces are supported as external or internal interfaces.

Note	PfR does not support Ethernet interfaces that are Layer 2 only, for example, Ethernet switched interfaces.

Configuring an interface as external enters PfR border exit configuration mode. Under PfR border exit interface configuration mode, you can configure maximum link utilization on a per-interface basis with the max-xmit-utilization (PfR) command.

Note	Entering the interface command without the external or internal keyword places the router in global configuration mode and not PfR border exit configuration mode. The no form of this command should be applied carefully so that active interfaces are not removed from the router configuration.

Usage Guidelines

The jitter command is used to specify the maximum tolerable jitter value permitted on an exit link. Jitter is a measure of voice quality where the lower the jitter value, the better the voice quality. If the jitter value is greater than the user-defined or the default value, PfR determines that the exit link is out-of-policy and searches for an alternate exit link.

Another measure of voice quality is the estimated Mean Opinion Score (MOS). Use the mos command and the jitter command in a PfR policy to define voice quality.

Usage Guidelines

The keepalive command is entered on a master controller. The PfR master controller sends keepalive packets to border routers to maintain connectivity between the master controller and the border router. If the master controller does not receive keepalive packets from a border router before the keepalive timer expires and this situation happens three times in a row, then the master controller will not maintain the connection.

Usage Guidelines

The learn command is entered on a master controller and is used to enter PfR Top Talker and Top Delay learning configuration mode to configure a master controller to learn and optimize prefixes based on the highest throughput or the highest delay. Under the Top Talker and Top Delay learning configuration mode, you can configure prefix learning based on delay and throughput statistics. You can configure the length of the prefix learning period, the interval between prefix learning periods, the number of prefixes to learn, and the prefix learning based on protocol.

Note	With CSCtr26978, learn mode using throughput is enabled by default.

Usage Guidelines

Link groups are used to define a group of exit links as a preferred set of links or as a fallback set of links for PfR to use when optimizing a specified traffic class. Up to three link groups can be specified for each interface. Configure this command on a master controller to define the link group for an interface, and use the set link-group (PfR) command to define the primary link group and a fallback link group for a specified traffic class in a PfR map.

Use the show pfr master link-group command to view information about configured PfR link groups.

Usage Guidelines

Learn lists are a way to categorize learned traffic classes. In each learn list, different criteria for learning traffic classes including prefixes, application definitions, filters, and aggregation parameters can be configured. A traffic class is automatically learned by PfR based on each learn list criteria, and each learn list is configured with a sequence number. The sequence number determines the order in which learn list criteria are applied. Learn lists allow different PfR policies to be applied to each learn list; in previous releases the traffic classes could not be divided, and a PfR policy was applied to all the traffic classes profiled during one learning session.

New traffic-class commands were introduced under learn list configuration mode to simplify the learning of traffic classes. Three types of traffic classes--to be automatically learned--can be profiled:

• Traffic classes based on destination prefixes.

• Traffic classes representing custom application definitions using access lists.

• Traffic classes based on a static application mapping name with an optional prefix list filtering to define destination prefixes.

Only one type of traffic-class command can be specified per learn list, and the throughput (PfR) and delay (PfR) commands are also mutually exclusive within a learn list.

Usage Guidelines

The local command is configured on a PfR border router. This command is used to specify the source interface IP address that will be used for communication between a border router and a master controller.

The IP address that is configured for the local interface must also be configured on the master controller using the border (PfR) command and the interface (PfR) command.

The no form of this command cannot be entered while the border router process is active. The border router process must first be stopped with the shutdown (PfR) command. If you stop the border router process to deconfigure the local interface with the no form of this command, you must configure another local interface before the border router process will reestablish communication with the master controller.

Usage Guidelines

The logging command is entered on a master controller or border router. System logging is enabled and configured in Cisco IOS software under global configuration mode. The logging command in PfR master controller or PfR border router configuration mode is used only to enable or disable system logging under PfR. PfR system logging supports the following message types:

• Error Messages—These messages indicate PfR operational failures and communication problems that can impact normal PfR operation.

• Debug Messages—These messages are used to monitor detailed PfR operations to diagnose operational or software problems.

• Notification Messages—These messages indicate that PfR is performing a normal operation.

• Warning Messages—These messages indicate that PfR is functioning properly, but an event outside of PfR may be impacting normal PfR operation.

Note	With CSCtx06699, PfR syslog levels are added to minimize the number of messages displayed, and a syslog notice is added to display when 30 percent of the traffic classes are out-of-policy.

Note

With CSCts74631, PfR syslog levels are added to minimize the number of messages displayed, a syslog notice is added to display when 30 percent of the traffic classes are out-of-policy, and new syslog alerts are added for a PfR version mismatch, an MC-BR authentication error, and when minimum PfR requirements are not met and the master controller is disabled because there are less than two operational external interfaces.

To modify system, terminal, destination, and other system global logging parameters, use the logging commands in global configuration mode. For more information about system logging commands, see the Cisco IOS Configuration Fundamentals Command Reference.

Cisco IOS XE Release 3.1S

This command is supported only in PfR border router configuration mode.

Usage Guidelines

The loss command is used to specify the relative percentage or maximum number of packets that PfR will permit to be lost during transmission on an exit link. If packet loss is greater than the user-defined or default value, PfR determines that the exit link is out-of-policy and searches for an alternate exit link.

The relative keyword is used to configure the relative packet loss percentage. The relative packet loss percentage is based on a comparison of short-term and long-term packet loss. The short-term measurement reflects the percentage of packet loss within a 5-minute period. The long-term measurement reflects the percentage of packet loss within a 60-minute period. The following formula is used to calculate this value:

Relative packet loss = ((short-term loss - long-term loss) / long-term loss) * 100

The master controller measures the difference between these two values as a percentage. If the percentage exceeds the user-defined or default value, the exit link is determined to be out-of-policy. For example, if long-term packet loss is 200 PPM and short-term packet loss is 300 PPM, the relative loss percentage is 50 percent.

The threshold keyword is used to configure the absolute maximum packet loss. The maximum value is based on the actual number of PPM that have been lost.

Usage Guidelines

The master command is entered on a border router. This command is used to establish communication between a PfR border router and a master controller. Communication is established between the border router process and the master controller process to allow the master controller to monitor and control PfR exit links. PfR communication must also be established on the master controller with the border PfR master controller configuration command. At least one border router must be configured to enable PfR. A maximum of ten border routers can be configured to communicate with a single master controller. The IP address that is used to specify the border router must be assigned to a local interface on the border router and must be reachable by the master controller.

By default, passive monitoring in PfR observe mode is enabled when communication is established between a master controller and a border router. Communication between the master controller and the border router is protected by key-chain authentication. The authentication key must be configured on both the master controller and the border router before communication can be established. The key-chain configuration is defined in global configuration mode on both the master controller and the border router before key-chain authentication is enabled for communication between a master controller and a border router. For more information about key management in Cisco IOS software, see the "Managing Authentication Keys" section in the "Configuring IP Protocol-Independent Features" chapter of the Cisco IOS IP Routing: Protocol-Independent Configuration Guide.

Usage Guidelines

Use this command to configure domain policies on a master hub controller. Domain policies are defined only on the hub-master controller and then sent over peering infrastructure to all the branch-master controllers. Policies can be defined per application or per differentiated service code point (DSCP). You cannot mix and match DSCP and application-based policies in the same class group. Traffic that does not match any of the classification and match statements falls into a default group, which is load balanced (no performance measurement is done).

Note	You can define policies based on either per application or per differentiated services code point (DSCP) but, you cannot mix and match DSCP and application-based policies in the same class group. You can use predefined policies from the template or create custom policies.

Usage Guidelines

The match ip address (PfR) command defines a policy, within a PfR map, for a list of prefixes. The match ip address (PfR) command is entered on a master controller in PfR map configuration mode. This command is used to configure a named extended access list or IP prefix list as a match criteria in a PfR map. Only one match clause can be configured for each PfR map sequence. The access list is created with the ip access-list command. Only named extended IP access lists are supported. The IP prefix list is created with the ip prefix-list command. A prefix can be any IP network number combined with a prefix mask that specifies the prefix length.

The inside keyword is used to support PfR BGP inbound optimization which in turn supports best entrance selection for traffic that originates from prefixes outside an autonomous system destined for prefixes inside the autonomous system. External BGP (eBGP) advertisements from an autonomous system to an Internet service provider (ISP) can influence the entrance path for traffic entering the network. PfR uses eBGP advertisements to manipulate the best entrance selection.

Usage Guidelines

The match pfr learn command is entered on a master controller in PfR map configuration mode. PfR can be configured to learn prefixes based on delay, inside prefix, criteria specified in a learn list, or throughput. This command is used to configure PfR learned prefixes as match criteria in a PfR map. Only one match clause can be configured for each PfR map sequence.

Usage Guidelines

The match traffic-class access-list command is used to manually configure a traffic class that matches destination prefixes in an access list used in a PfR map. Only one access list can be specified, but the access list may contain many access list entries to help define the traffic class.

Note

The match traffic-class application (PfR) command, the match traffic-class application nbar (PfR) command, the match traffic-class access-list (PfR) command, and the match traffic-class prefix-list (PfR) commands are all mutually exclusive in a PfR map. Only one of these commands can be specified per PfR map.

Usage Guidelines

The match traffic-class application command is used to manually configure the master controller to profile traffic destined for prefixes defined in an IP prefix list that match one or more applications. The applications are predefined with a protocol--TCP or UDP, or both--and one or more ports and this mapping is shown in the table below. More than one application can be configured as part of the traffic class.

Note

The match traffic-class application (PfR) command, the match traffic-class application nbar (PfR) command, the match traffic-class access-list (PfR) command, and the match traffic-class prefix-list (PfR) commands are all mutually exclusive in a PfR map. Only one of these commands can be specified per PfR map.

The table below displays the keywords that represent the application that can be configured with the match traffic-class application command. Replace the application-name argument with the appropriate keyword from the table.

Usage Guidelines

The match traffic-class application nbar command is used to manually configure the master controller to profile traffic destined for prefixes defined in an IP prefix list that match one or more applications identified using NBAR. More than one application can be configured as part of the traffic class with a maximum of ten applications entered per command line. Enter multiple match traffic-class application nbar command statements if you need to specify more than ten applications.

NBAR can identify applications based on the following three types of protocols:

• Non-UDP and non-TCP IP protocols—For example, generic routing encapsulation (GRE) and Internet Control Message Protocol (ICMP).

• TCP and UDP protocols that use statically assigned port numbers—For example, CU-SeeMe desktop video conference (CU-SeeMe-Server), Post Office Protocol over Transport Layer Security (TLS), and Secure Sockets Layer (SSL) server (SPOP3-Server).

• TCP and UDP protocols that dynamically assign port numbers and require stateful inspection—For example, Real-Time Transport Protocol audio streaming (RTP-audio) and BitTorrent file transfer traffic (BitTorrent).

Use the match traffic-class application nbar ? command to determine if an application can be identified using NBAR and replace the nbar-app-name argument with the appropriate keyword from the screen display.

The list of applications identified using NBAR and available for profiling PfR traffic classes is constantly evolving. For lists of many of the NBAR applications defined using static or dynamically assigned ports, see the “Performance Routing with NBAR/CCE Application and Recognition” module.

For more details about NBAR, see the “Classifying Network Traffic Using NBAR” section of the QoS: NBAR Configuration Guide.

Note

The following commands mutually exclusive in a PfR map. Only one of these commands can be specified per PfR map. match traffic-class access-list (PfR) command match traffic-class application (PfR) command match traffic-class application nbar (PfR) command match traffic-class prefix-list (PfR) command

Usage Guidelines

The match traffic-class prefix-list command is used to manually configure a traffic class that matches destination prefixes in a prefix list.

Use the optional inside keyword to specify prefixes that are within the internal network.

Note

The match traffic-class prefix-list (PfR) command, the match traffic-class access-list (PfR) command, the match traffic-class application (PfR), and the match traffic-class application nbar (PfR) commands are all mutually exclusive in a PfR map. Only one of these commands can be specified per PfR map.

Usage Guidelines

The max prefix command is entered on a PfR master controller. This command is used to limit the number of prefixes that a master controller will monitor and learn to reduce memory and system resource consumption.

The PfR/PBR Traffic Class Scaling Enhancement feature introduced new PFR and dynamic route-map scaling improvement on BR to support a maximum of 20,000 application traffic classes (TC) with a maximum of 500 dynamic route-map sequences. Currently only 5000 application traffic classes and 32 route map entries are allowed. On a Route Processor 2 (RP2)/ESP40 Cisco recommends a maximum of 500 branches with 20,000 application traffic classes. On a Route Processor 1 (RP1)/ESP10 Cisco recommends a maximum of 500 branches with 10,000 application traffic classes.

Note	If you configure a lower value for the total keyword than for the learn keyword, the value for the total keyword will also set the maximum number of prefixes that a master controller will learn.

Usage Guidelines

The max range receive command is configured on a master controller. This command is used to set a threshold link utilization range for all entrance interfaces on PfR border routers.

PfR entrance link range functionality attempts to keep the entrance links within a utilization range relative to each other to ensure that the traffic load is distributed. The range is specified either as an absolute value in kilobits per second (kb/s) or as a percentage and is configured on the master controller to apply to all the entrance links on border routers managed by the master controller. For example, in a PfR-managed network with two entrance links, if the range is specified as 25 percent and the utilization of the first entrance link is 70 percent, then if the utilization of the second entrance link falls to 40 percent, the percentage range between the two entrance links will be more than 25 percent and PfR will attempt to move some traffic classes to use the second entrance to even the traffic load.

Usage Guidelines

The maximum utilization receive command is entered on a master controller to set the maximum utilization threshold of incoming traffic that can be transmitted over a PfR-managed entrance link interface. This command is configured on a per-entrance-link basis. Use this command with the downgrade bgp (PfR) command to configure PfR BGP inbound optimization. This command can also be used with the max range receive (PfR) command to configure entrance link load balancing.

If traffic utilization goes above the threshold, PfR tries to move the traffic from this entrance link to another underutilized entrance link.

Usage Guidelines

The max-range-utilization command is configured on a master controller. This command is used to set a threshold link utilization range for all external interfaces on PfR border routers.

PfR exit link range functionality attempts to keep the exit links within a utilization range, relative to each other, to ensure that the traffic load is distributed. The range is specified as a percentage and is configured on the master controller to apply to all the exit links on border routers managed by the master controller. For example, in a PfR-managed network with two exit links, if the range is specified as 25-percent and the utilization of the first exit link is 70-percent, then if the utilization of the second exit link falls to 40-percent, the percentage range between the two exit links will be more than 25-percent and PfR will attempt to move some traffic classes to use the second exit to even the traffic load.

Usage Guidelines

The max-xmit-utilization command is entered on a master controller and allows you to set the maximum utilization bandwidth of outbound traffic that can be transmitted over a PfR-managed exit interface. The maximum utilization threshold can be expressed as an absolute value in kb/s or as a percentage. This command is configured on a per-exit-link basis and cannot be configured on PfR internal interfaces; internal interfaces are not used to forward traffic.

If the rate of traffic exceeds the threshold, PfR tries to move the traffic from this exit link to another underutilized exit link.

Usage Guidelines

The PfR Target Discovery feature introduces master controller peering using the configuration of Service Router (SR) forwarders on each master controller to establish peering between MCs at different sites and allow the advertisement of target-discovery data and the sharing of probe statistics from each site.

Depending on the network structure and the degree of control required over the configuration of probe targets and IP SLA responders, there are three main methods of configuring MC peering using the mc-peer command:

• Configuring a domain ID or using the default domain ID of 59501. This option requires EIGRP SAF configuration on both head-office and branch-office master controller routers and can be used in the SAF-everywhere type of network.

• Configuring the head-end (at the head office) or the peer IP address (at the branch office). This option requires a loopback interface to be configured as the source of EIGRP SAF adjacency. This configuration option is used in multihop/Darknet types of networks.

• Configuring the EIGRP option where there is no autoconfiguration of EIGRP SAF. This option is used in the SAF-everywhere type of network.

Note	With CSCud06237, when using the mc-peer eigrp command option in PfR target discovery, a loopback interface must be specified to enable PfR to select a local ID.

Usage Guidelines

Minimum mask value is applied on IP addresses to generate a prefix to be used on egress flows

Usage Guidelines

The mode monitor command is entered on a master controller. This command is used to configure passive monitoring and active monitoring. A prefix can be monitored both passively and actively.

Passive Monitoring

The master controller passively monitors IP prefixes and TCP traffic flows. Passive monitoring is configured on the master controller. Monitoring statistics are gathered on the border routers and then reported back to the master controller. PfR uses NetFlow to collect and aggregate passive monitoring statistics on a per prefix basis. No explicit NetFlow configuration is required. NetFlow support is enabled by default when passive monitoring is enabled. PfR uses passive monitoring to measure the following information:

• Delay --PfR measures the average delay of TCP flows for a prefix. Delay is the measurement of the time between the transmission of a TCP synchronization message and the receipt of the TCP acknowledgment.

• Packet Loss --PfR measures packet loss by tracking TCP sequence numbers for each TCP flow. PfR estimates packet loss by tracking the highest TCP sequence number. If a subsequent packet is received with a lower sequence number, PfR increments the packet loss counter.

• Reachability --PfR measures reachability by tracking TCP synchronization messages that have been sent repeatedly without receiving a TCP acknowledgment.

• Throughput --PfR measures outbound throughput for optimized prefixes. Throughput is measured in bits per second (bps).

Note	PfR passively monitors TCP traffic flows for IP traffic. Passive monitoring of non-TCP sessions is not supported.

Active Monitoring

PfR uses Cisco IOS IP Service Level Agreements (SLAs) to enable active monitoring. IP SLA support is enabled by default. IP SLA support allows PfR to be configured to send active probes to target IP addresses to measure the jitter and delay, determining if a prefix is out-of-policy and if the best exit is selected. The border router collects these performance statistics from the active probe and transmits this information to the master controller. The master controller uses this information to optimize the prefix and select the best available exit based on default and user-defined policies. The active-probe (PfR) command is used to create an active probe.

Usage Guidelines

The mode route command is entered on a master controller. This command is used to enable and configure route control mode and observe mode settings.

If you have different routing protocols operating on your PfR border routers (for example, BGP on one border router and EIGRP on another) you must configure the protocol and pbr keywords with the mode route command to allow destination-only traffic classes to be controlled using dynamic PBR. Entering the no mode route protocol pbr command will initially set the destination-only traffic classes to be uncontrolled and PfR will revert to the default behavior using a single protocol to control the traffic class in the following order: BGP, EIGRP, static, and PBR.

Note	With CSCtr26978, the mode route protocol pbr command is enabled by default.

Usage Guidelines

The master controller can be configured to select a new exit for an out-of-policy prefix based on performance or policy. You can configure the master controller to select the first in-policy exit by entering the good keyword, or you can configure the master controller to select the best exit with the best keyword. If the good keyword is used and there is no in-policy exit, the prefix is uncontrolled.

With CSCtr26978, the default behavior changed to select-exit good. No other option is available and the mode select-exit command was removed.

Usage Guidelines

The mode verify bidirectional command is entered on a master controller. With CSCtr26978, the default behavior changed to disable the verification of bidirectional traffic.

Usage Guidelines

Use this command on the hub device for the master controller configuration to configure monitor interval on ingress monitors.

Usage Guidelines

The monitor-period command is configured on a master controller. This command is used to adjust the length of time during which a master controller learns traffic flows on border routers. The length of time between monitoring periods is configured with the periodic-interval (PfR) command. The number of prefixes that are learned is configured with the prefixes (PfR) command.

Usage Guidelines

The mos command is used to determine voice quality. The number of MOS samples over a period of time that are below the threshold MOS value are calculated. If the percentage of MOS samples below the threshold is greater than the configured percentage, PfR determines that the exit link is out-of-policy and searches for an alternate exit link.

Another measure of voice quality is the jitter value. Use the mos (PfR) command and the jitter (PfR) command in a PfR policy to define voice quality.

Usage Guidelines

The path-preference command is configured on the hub-master controller to configure the WAN paths.

Usage Guidelines

The periodic command is entered on a master controller. This command is used to configure the master controller to evaluate and then make policy decisions for PfR managed exit links. When the periodic timer expires, the master controller evaluates current exit links based on default or user-defined policies. If all exit links are in-policy, no changes are made. If an exit link is out-of-policy, the affected prefixes are moved to an in-policy exit link. If all exit links are out-of-policy, the master controller will move out-of-policy prefixes to the best available exit links.

The master controller can be configured to select the first in-policy exit when the periodic timer expires, by configuring the mode select-exit command with the good keyword. The master controller can also be configured to select the best available in-policy exit, by configuring the mode select-exit command with the best keyword.

The periodic timer is reset to the default or configured value each time the timer expires. Configuring a new timer value will immediately replace the existing value if the new value is less than the time remaining. If the new value is greater than the time remaining, the new timer value will be used when the existing timer value expires.

Usage Guidelines

The periodic-interval command is configured on a master controller. This command is used to adjust the length of time between traffic flow monitoring periods. The length of time of the learning period is configured with the monitor-period (PfR) command. The number of prefixes that are monitored is configured with the prefixes (PfR) command.

Usage Guidelines

The pfr command is entered on a router to create a border router or master controller process to enable Cisco IOS PfR, which allows you to enable automatic outbound route control and load distribution for multihomed and enterprise networks. Configuring PfR allows you to monitor IP traffic flows and then define policies and rules based on link performance and link load distribution to alter routing and improve network performance.

Performance Routing comprises two components: the master controller (MC) and the border router (BR). A PfR deployment requires one MC and one or more BRs. Communication between the MC and the BR is protected by key-chain authentication. Depending on your Performance Routing deployment scenario and scaling requirements, the MC may be deployed on a dedicated router or may be deployed along with the BR on the same physical router.

Master Controller—The MC is a single router that acts as the central processor and database for the Performance Routing system. The MC component does not reside in the forwarding plane and, when deployed in a standalone fashion, has no view of routing information contained within the BR. The master controller maintains communication and authenticates the sessions with the BRs. The role of the MC is to gather information from the BR or BRs to determine whether traffic classes are in or out of policy and to instruct the BRs how to ensure that traffic classes remain in policy using route injection or dynamic PBR injection.

Border Router—The BR component resides within the data plane of the edge router with one or more exit links to an ISP or other participating network. The BR uses NetFlow to passively gather throughput and TCP performance information. The BR also sources all IP service-level agreement (SLA) probes used for explicit application performance monitoring. The BR is where all policy decisions and changes to routing in the network are enforced. The BR participates in prefix monitoring and route optimization by reporting prefix and exit link measurements to the master controller and then by enforcing policy changes received from the master controller. The BR enforces policy changes by injecting a preferred route to alter routing in the network.

Disabling a Border Router or a Master Controller

To disable a master controller or border router and completely remove the process configuration from the running configuration file, use the no form of this command in global configuration mode.

To temporarily disable a master controller or border router process, use the shutdown (PfR) command in PfR master controller or PfR border router configuration mode. Entering the shutdown (PfR) command stops an active master controller or border router process but does not remove any configuration parameters. The shutdown (PfR) command is displayed in the running configuration file when enabled.

Cisco IOS XE Releases 3.1S and 3.2S

In Cisco IOS XE Releases 3.1S and 3.2S, only the border keyword is supported.

Note	In Cisco IOS XE Release 3.3S, support for master controller was introduced.

Usage Guidelines

The pfr-map command is configured on a master controller. The operation of a PfR map is similar to the operation of a route map. A PfR map is designed to select IP prefixes or to select PfR learn policies using a match clause and then to apply PfR policy configurations using a set clause. The PfR map is configured with a sequence number like a route map, and the PfR map with the lowest sequence number is evaluated first. The operation of a PfR map differs from a route map at this point. There are two important distinctions:

• Only a single match clause may be configured for each sequence. An error message will be displayed on the console if you attempt to configure multiple match clauses for a single PfR map sequence.

• A PfR map is not configured with permit or deny statements. However, a permit or deny sequence can be configured for an IP traffic flow by configuring a permit or deny statement in an IP prefix list and then applying the prefix list to the PfR map with the match ip address (PfR) command.

Tip	Deny prefixes should be combined in a single prefix list and applied to the PfR map with the lowest sequence number.

A PfR map can match a prefix or prefix range with the match ip address (PfR) command. A prefix can be any IP network number combined with a prefix mask that specifies the prefix length. The prefix or prefix range is defined with the ip prefix-list command in global configuration mode. Any prefix length can be specified. A PfR map can also match PfR learned prefixes with the match pfr learn command. Matching can be configured for prefixes learned based on delay or based on throughput.

The PfR map applies the configuration of the set clause after a successful match occurs. A PfR set clause can be used to set policy parameters for the backoff timer, packet delay, holddown timer, packet loss, mode settings, periodic timer, resolve settings, and unreachable hosts.

Policies that are applied by a PfR map do not override global policies configured under PfR master controller configuration mode and PfR Top Talker and Delay learning configuration mode. Policies are overridden on a per-prefix-list basis. If a policy type is not explicitly configured in a PfR map, the default or configured values will apply. Policies applied by a PfR map take effect after the current policy or operational timer expires. The PfR map configuration can be viewed in the output of the show running-config command. PfR policy configuration can be viewed in the output of the show pfr master policy command.

Usage Guidelines

The platform nft_summarization command is used to enable the collection of the packets punted to the CPU by using the NFT hash table. Data is collected until the user disables the command.

Usage Guidelines

You can use the platform nft_summarization timer-value command to enable the optional timer value to clean up the NFT data as per the timestamps, which are collected for each entry in the hash table. Some of these entries in the hash table are source MAC address, destination MAC address, Ethertype, and Prototype. Whenever an entry is added to the hash table, the corresponding timestamp will be added. After the configured timer expires, the hash table clean-up will be triggered to remove the entries that have older timestamps greater than the configured seconds.