CreateTrafficMarkingPolicy - Cloud Enterprise Network - Alibaba Cloud Documentation Center

Creates a traffic marking policy. A traffic marking policy captures network traffic based on traffic classification rules and marks the traffic with the Differentiated Services Code Point (DSCP) values that you specify.

Operation description

Only Enterprise Edition transit routers support traffic marking policies.
CreateTrafficMarkingPolicy is an asynchronous operation. After you send a request, the system returns a traffic marking policy ID and runs the task in the background. You can call the ListTrafficMarkingPolicies operation to query the status of a traffic marking policy.
- If a traffic marking policy is in the Creating state, the traffic marking policy is being created. You can query the traffic marking policy but cannot perform other operations.
- If a traffic marking policy is in the Active state, the traffic marking policy is created.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Debug

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

Operation: the value that you can use in the Action element to specify the operation on a resource.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition Key: the condition key that is defined by the cloud service.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Operation	Access level	Resource type	Condition key	Associated operation
cen:CreateTrafficMarkingPolicy	Write	CenInstance acs:cen::{#accountId}:ceninstance/	none	none

Request parameters

Parameter	Type	Required	Description	Example
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate the value, but you must make sure that it is unique among all requests. The client token can contain only ASCII characters. Note If you do not set this parameter, ClientToken is set to the value of RequestId. The value of RequestId for each API request may be different.	123e4567-e89b-12d3-a456-426****
DryRun	boolean	No	Specifies whether to perform a dry run. Valid values: true: performs a dry run. The system checks the required parameters, request format, and limits. If the request fails the dry run, an error message is returned. If the request passes the dry run, the `DryRunOperation` error code is returned. false (default): performs a dry run and sends the request.	false
TransitRouterId	string	Yes	The ID of the transit router.	tr-8vbuqeo5h5pu3m01d****
TrafficMarkingPolicyName	string	No	The name of the traffic marking policy. The name can be empty or 1 to 128 characters in length, and cannot start with http:// or https://.	nametest
TrafficMarkingPolicyDescription	string	No	The description of the traffic marking policy. This parameter is optional. If you enter a description, it must be 1 to 256 characters in length, and cannot start with http:// or https://.	desctest
Priority	integer	Yes	The priority value of the traffic marking policy. Valid values: 1 to 100. The priority value of each traffic marking policy on a transit router must be unique. A smaller value specifies a higher priority.	5
MarkingDscp	integer	Yes	The differentiated services code point (DSCP) value to be added to packets that match the traffic classification rule. Valid values: 0 to 63. The DSCP value of each traffic marking policy on a transit router must be unique.	5
TrafficMatchRules	object []	No	The traffic classification rules in the traffic marking policy. Data packets that meet the traffic classification rule is assigned the DSCP value of quality of service (QoS) policy. You can create up to 50 traffic classification rules.
MatchDscp	integer	No	The DSCP value that is used to match packets. Valid values: 0 to 63. Packets that carry the specified DSCP value meet the traffic classification rule. If you do not specify a DSCP value, all packets meet the traffic classification rule. Note The DSCP value that you specify for this parameter is the DSCP value that packets carry before they are transmitted over the inter-region connection. You can create up to 50 traffic classification rules in each call. You can specify a DSCP value for each traffic classification rule.	6
DstCidr	string	No	The destination CIDR block that is used to match packets. Packets whose destination IP addresses fall into the specified destination CIDR block meet the traffic classification rule. If you do not specify a destination CIDR block, all packets meet the traffic classification rule. You can create up to 50 traffic classification rules in each call You can specify a destination CIDR block for each traffic classification rule.	10.10.10.0/24
TrafficMatchRuleDescription	string	No	The description of the traffic classification rule. You can create up to 50 traffic classification rules in each call. You can specify a description for each traffic classification rule. This parameter is optional. If you enter a description, it must be 1 to 256 characters in length, and cannot start with http:// or https://.	desctest
Protocol	string	No	The protocol that is used to match packets. Traffic classification rules support the following protocols: HTTP, HTTPS, TCP, UDP, SSH, and Telnet. For more information, log on to the CEN console. Some protocols use a fixed port. Click to view protocols and ports. If the protocol is ICMP, the destination port must be -1. If the protocol is GRE, the destination port must be 1. If the protocol is SSH, the destination port must be 22. If the protocol is Telnet, the destination port must be 23. If the protocol is HTTP, the destination port must be 80. If the protocol is HTTPS, the destination port must be 443. If the protocol is MS SQL, the destination port must be 1443. If the protocol is Oracle, the destination port must be 1521. If the protocol is Mysql, the destination port must be 3306. If the protocol is RDP, the destination port must be 3389. If the protocol is Postgre SQL, the destination port must be 5432. If the protocol is Redis, the destination port must be 6379. You can create up to 50 traffic classification rules in each call. You can specify a protocol for each traffic classification rule.	HTTP
DstPortRange	array	No	The destination port range that is used to match packets. Valid values: -1 and 1 to 65535. Packets whose destination ports fall within the destination port range meet the traffic classification rule. If you do not specify destination port range, all packets meet the traffic classification rule. You can enter up to two port numbers. Take note of the following rules: If you enter only one port number, such as 1, packets whose destination port is 1 meet the traffic classification rule. If you enter two port numbers, such as 1 and 200, packets whose destination ports fall into 1 and 200 meet the traffic classification rule. If you enter two port numbers and one of them is -1, the other port number must also be -1. In this case, all packets meet the traffic classification rule. You can create up to 50 traffic classification rules in each call. You can specify a destination port range for each traffic classification rule.
	integer	No	The destination port range that is used to match packets. Valid values: -1 and 1 to 65535. Packets whose destination ports fall within the destination port range meet the traffic classification rule. If you do not specify destination port range, all packets meet the traffic classification rule. You can enter up to two port numbers. Take note of the following rules: If you enter only one port number, such as 1, packets whose destination port is 1 meet the traffic classification rule. If you enter two port numbers, such as 1 and 200, packets whose destination ports fall into 1 and 200 meet the traffic classification rule. If you enter two port numbers and one of them is -1, the other port number must also be -1. In this case, all packets meet the traffic classification rule. You can create up to 50 traffic classification rules in each call. You can specify a destination port range for each traffic classification rule.	80
SrcCidr	string	No	The source CIDR block that is used to match packets. Packets whose source IP addresses fall into the specified source CIDR block meet the traffic classification rule. If you do not specify a source CIDR block, all packets meet the traffic classification rule. You can create up to 50 traffic classification rules in each call. You can specify a source CIDR block for each traffic classification rule.	192.168.10.0/24
SrcPortRange	array	No	The source port range that is used to match packets. Valid values: -1 and 1 to 65535. Packets whose source ports fall into the source port range meet the traffic classification rule. If you do not specify a source port range, all packets meet the traffic classification rule. You can enter up to two port numbers. Take note of the following rules: If you enter only one port number, such as 1, packets whose source port is 1 meet the traffic classification rule. If you enter two port numbers, such as 1 and 200, packets whose source ports fall into 1 and 200 meet the traffic classification rule. If you enter two port numbers and one of them is -1, the other port number must also be -1. In this case, all packets meet the traffic classification rule. You can create up to 50 traffic classification rules in each call. You can specify a source port range for each traffic classification rule.
	integer	No	The source port range that is used to match packets. Valid values: -1 and 1 to 65535. Packets whose source ports fall within the source port range meet the traffic classification rule. If you do not specify a source port range, all packets meet the traffic classification rule. You can enter up to two port numbers. Take note of the following rules: If you enter only one port number, such as 1, packets whose source port is 1 meet the traffic classification rule. If you enter two port numbers, such as 1 and 200, packets whose source ports fall into 1 and 200 meet the traffic classification rule. If you enter two port numbers and one of them is -1, the other port number must also be -1. In this case, all packets meet the traffic classification rule. You can create up to 50 traffic classification rules in each call. You can specify a source port range for each traffic classification rule.	1
TrafficMatchRuleName	string	No	The name of the traffic classification rule. You can create up to 50 traffic classification rules in each call. You can specify a name for each traffic classification rule. The name can be empty or 1 to 128 characters in length, and cannot start with http:// or https://.	nametest

Response parameters

Parameter	Type	Description	Example
	object	The response.
TrafficMarkingPolicyId	string	The ID of the traffic marking policy.	tm-u9nxup5kww5po8****
RequestId	string	The ID of the request.	0876E54E-3E36-5C31-89F0-9EE8A9266F9A

Examples

Sample success responses

JSONformat

{
  "TrafficMarkingPolicyId": "tm-u9nxup5kww5po8****",
  "RequestId": "0876E54E-3E36-5C31-89F0-9EE8A9266F9A"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidTransitRouterId.NotFound	TransitRouterId is not found.	The error message returned because the ID of the transit router does not exist.
400	IllegalParam.Protocol	Protocol is illegal.	The error message returned because the specified protocol is invalid.
400	OperationFailed.TransitRouterType	Operation failed because The Basic TransitRouter does not support this action.	The error message returned because this operation is not supported by Basic Edition transit routers.
400	IllegalParam.Priority	Priority is illegal.	The error message returned because the specified priority is invalid.
400	IllegalParam.MarkingDscp	MarkingDscp is illegal.	The error message returned because the MarkingDscp parameter is set to an invalid value.
400	IllegalParam.SrcCidr	SrcCidr is illegal.	The error message returned because the specified source CIDR block is invalid.
400	IllegalParam.DstCidr	DstCidr is illegal.	The error message returned because the specified destination CIDR block (DstCidr) is invalid.
400	Duplicated.Priority	The parameter Priority is duplicated.	The error message returned because duplicate priorities are specified.
400	Duplicated.MarkingDscp	The parameter MarkingDscp is duplicated.	The error message returned because the MarkingDscp parameter specifies duplicate descriptions.
400	Duplicated.TrafficMatchRules	The parameter TrafficMatchRules are duplicated.	The error message returned because the traffic match rules (TrafficMatchRules) are duplicate.
400	QuotaExceeded.TrafficMatchRule	The maximum number of TrafficMatchRule per Transit Router is exceeded.	The number of flow classification rules supported by each forwarding router instance exceeds the limit. You can submit a work order to increase the quota.
400	IllegalParam.MatchDscp	MarkingDscp is invalid.	MarkingDscp parameter is illegal.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.