Create a traffic marking policy by calling the CreateTrafficMarkingPolicy API - Cloud Enterprise Network - Alibaba Cloud - Cloud Enterprise Network

A traffic marking policy captures traffic that matches traffic classification rules and adds a Differentiated Services Code Point (DSCP) value to the traffic as a mark. Creates a traffic marking policy by calling CreateTrafficMarkingPolicy.

Operation description

Only Enterprise Edition transit routers support creating traffic marking policies.
CreateTrafficMarkingPolicy is an asynchronous operation. After you send a request, the system returns a traffic marking policy ID but the traffic marking policy is not yet created. The system continues to create the traffic marking policy in the background. You can call ListTrafficMarkingPolicies to query the status of the traffic marking policy.
- If the traffic marking policy is in the Creating state, the traffic marking policy is being created. In this state, you can only query the traffic marking policy but cannot perform other operations.
- If the traffic marking policy is in the Active state, the traffic marking policy is created.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cen:CreateTrafficMarkingPolicy

create

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The client token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.	123e4567-e89b-12d3-a456-426****
DryRun	boolean	No	Specifies whether to perform a dry run. Valid values: true: performs a dry run. The system checks the required parameters, request syntax, and business restrictions. If the request fails the dry run, an error message is returned. If the request passes the dry run, the `DryRunOperation` error code is returned. false (default): performs a dry run and sends the request. If the request passes the dry run, the traffic marking policy is created.	false
TransitRouterId	string	Yes	The instance ID of the forward routing transit router.	tr-8vbuqeo5h5pu3m01d****
TrafficMarkingPolicyName	string	No	The name of the traffic marking policy. The name can be empty or 1 to 128 characters in length, and cannot start with http:// or https://.	nametest
TrafficMarkingPolicyDescription	string	No	The description of the traffic marking policy. The description can be empty or 1 to 256 characters in length, and cannot start with http:// or https://.	desctest
Priority	integer	Yes	The priority of the traffic marking policy. Valid values: 1 to 100. The priority of each traffic marking policy under a transit router instance must be unique. A smaller value indicates a higher priority.	5
MarkingDscp	integer	Yes	The DSCP value to be added to traffic packets that match the traffic classification rules. Valid values: 0 to 63. The DSCP value of each traffic marking policy under a transit router instance must be unique.	5
TrafficMatchRules	array<object>	No	The list of traffic classification rules for the traffic marking policy. Traffic packets that match the traffic classification rules are marked with the DSCP value of the traffic marking policy. You can create up to 50 traffic classification rules at a time.
	object	No	The traffic classification rule information.
MatchDscp	integer	No	The DSCP value of traffic packets. Valid values: 0 to 63. The traffic classification rule matches traffic that contains the specified DSCP value. If you do not set this parameter, the traffic classification rule matches traffic with any DSCP value. Note The DSCP value refers to the DSCP value that the traffic packets already carry before entering the inter-region connection. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can match one DSCP value.	6
DstCidr	string	No	The destination CIDR block of traffic packets. IPv4 and IPv6 addresses are supported. The traffic classification rule matches traffic whose destination IP address falls within the destination CIDR block. If you do not set this parameter, the traffic classification rule matches traffic with any destination IP address. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can specify one destination CIDR block.	10.10.10.0/24
TrafficMatchRuleDescription	string	No	The description of the traffic classification rule. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can have one description. The description can be empty or 1 to 256 characters in length, and cannot start with http:// or https://.	desctest
Protocol	string	No	The protocol type of traffic packets. The traffic marking policy supports matching traffic of multiple protocol types such as HTTP, HTTPS, TCP, UDP, SSH, and Telnet. For more protocol types, log on to the Cloud Enterprise Network (CEN) console. Some protocols have fixed ports. Click to view port details. If the protocol type is ICMP, the destination port must be set to -1. If the protocol type is GRE, the destination port must be set to -1. If the protocol type is SSH, the destination port must be set to 22. If the protocol type is Telnet, the destination port must be set to 23. If the protocol type is HTTP, the destination port must be set to 80. If the protocol type is HTTPS, the destination port must be set to 443. If the protocol type is MS SQL, the destination port must be set to 1443. If the protocol type is Oracle, the destination port must be set to 1521. If the protocol type is Mysql, the destination port must be set to 3306. If the protocol type is RDP, the destination port must be set to 3389. If the protocol type is Postgre SQL, the destination port must be set to 5432. If the protocol type is Redis, the destination port must be set to 6379. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can match one protocol type.	HTTP
DstPortRange	array	No	The destination port of traffic packets. Valid values: -1 and 1 to 65535. The traffic classification rule matches traffic whose destination port falls within the destination port range. If you do not set this parameter, the traffic classification rule matches traffic with any destination port. This parameter supports up to two port numbers. The input format is described as follows: If you enter only one port number, such as 1, the system matches traffic whose destination port is 1 by default. If the value is -1, the system matches traffic with any destination port. If you enter two port numbers, such as 1 and 200, the system matches traffic whose destination port is in the range of 1 to 200 by default. If you enter two port numbers and one of them is -1, the other port number must also be -1, which indicates matching traffic with any destination port. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can specify one destination port range.
	integer	No	The destination port of traffic packets. Valid values: -1 and 1 to 65535. The traffic classification rule matches traffic whose destination port falls within the destination port range. If you do not set this parameter, the traffic classification rule matches traffic with any destination port. This parameter supports up to two port numbers. The input format is described as follows: If you enter only one port number, such as 1, the system matches traffic whose destination port is 1 by default. If you enter two port numbers, such as 1 and 200, the system matches traffic whose destination port is in the range of 1 to 200 by default. If you enter two port numbers and one of them is -1, the other port number must also be -1, which indicates matching traffic with any destination port. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can specify one destination port range.	80
SrcCidr	string	No	The source CIDR block of traffic packets. IPv6 and IPv4 addresses are supported. The traffic classification rule matches traffic whose source IP address falls within the source CIDR block. If you do not set this parameter, the traffic classification rule matches traffic with any source IP address. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can match one source CIDR block.	192.168.10.0/24
SrcPortRange	array	No	The source port of traffic packets. Valid values: -1 and 1 to 65535. The traffic classification rule matches traffic whose source port falls within the source port range. If you do not set this parameter, the traffic classification rule matches traffic with any source port. This parameter supports up to two port numbers. The input format is described as follows: If you enter only one port number, such as 1, the system matches traffic whose source port is 1 by default. If the value is -1, the system matches traffic with any source port. If you enter two port numbers, such as 1 and 200, the system matches traffic whose source port is in the range of 1 to 200 by default. If you enter two port numbers and one of them is -1, the other port number must also be -1, which indicates matching traffic with any source port. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can specify one source port range.
	integer	No	The source port of traffic packets. Valid values: -1 and 1 to 65535. The traffic classification rule matches traffic whose source port falls within the source port range. If you do not set this parameter, the traffic classification rule matches traffic with any source port. This parameter supports up to two port numbers. The input format is described as follows: If you enter only one port number, such as 1, the system matches traffic whose source port is 1 by default. If you enter two port numbers, such as 1 and 200, the system matches traffic whose source port is in the range of 1 to 200 by default. If you enter two port numbers and one of them is -1, the other port number must also be -1, which indicates matching traffic with any source port. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can specify one source port range.	1
TrafficMatchRuleName	string	No	The name of the traffic classification rule. You can create up to 50 traffic classification rules at a time, and each traffic classification rule can have one name. The name can be empty or 1 to 128 characters in length, and cannot start with http:// or https://.	nametest
AddressFamily	string	No	The address type. Valid values: IPv4, IPv6, or empty.	IPv4

Response elements

Element	Type	Description	Example
	object	The response parameters.
TrafficMarkingPolicyId	string	The ID of the traffic marking policy.	tm-u9nxup5kww5po8****
RequestId	string	The request ID.	0876E54E-3E36-5C31-89F0-9EE8A9266F9A

Examples

Success response

JSON format

{
  "TrafficMarkingPolicyId": "tm-u9nxup5kww5po8****",
  "RequestId": "0876E54E-3E36-5C31-89F0-9EE8A9266F9A"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidTransitRouterId.NotFound	TransitRouterId is not found.	The error message returned because the ID of the transit router does not exist.
400	IllegalParam.Protocol	Protocol is illegal.	The error message returned because the specified protocol is invalid.
400	OperationFailed.TransitRouterType	Operation failed because The Basic TransitRouter does not support this action.	The error message returned because this operation is not supported by Basic Edition transit routers.
400	IllegalParam.Priority	Priority is illegal.	The error message returned because the specified priority is invalid.
400	IllegalParam.MarkingDscp	MarkingDscp is illegal.	The error message returned because the MarkingDscp parameter is set to an invalid value.
400	IllegalParam.SrcCidr	SrcCidr is illegal.	The error message returned because the specified source CIDR block is invalid.
400	IllegalParam.DstCidr	DstCidr is illegal.	The error message returned because the specified destination CIDR block (DstCidr) is invalid.
400	Duplicated.Priority	The parameter Priority is duplicated.	The error message returned because duplicate priorities are specified.
400	Duplicated.MarkingDscp	The parameter MarkingDscp is duplicated.	The error message returned because the MarkingDscp parameter specifies duplicate descriptions.
400	Duplicated.TrafficMatchRules	The parameter TrafficMatchRules are duplicated.	The error message returned because the traffic match rules (TrafficMatchRules) are duplicate.
400	QuotaExceeded.TrafficMatchRule	The maximum number of TrafficMatchRule per Transit Router is exceeded.	The number of flow classification rules supported by each forwarding router instance exceeds the limit. You can submit a work order to increase the quota.
400	IllegalParam.MatchDscp	MarkingDscp is invalid.	MarkingDscp parameter is illegal.
400	IllegalParam.SrcPortRange	The specified SrcPortRange is illegal.	The source port is invalid.
400	IllegalParam.DstPortRange	The specified DstPortRange is illegal.	The specified DstPortRange is illegal.
400	AttrMismatching.CidrAddressFamily	Attribute SrcCidr or DstCidr of TrafficMarkRule does not match AddressFamily.	Attribute SrcCidr or DstCidr of TrafficMarkRule does not match AddressFamily.
400	IllegalParam.AddressFamily	AddressFamily is illegal.	The AddressFamily value of the request parameter is invalid. Valid values are IPv4 or IPv6.
400	AttrMismatching.SrcCidrDstCidr	Attribute SrcCidr of TrafficMarkRule does not match DstCidr.	Attribute SrcCidr of TrafficMarkRule does not match DstCidr.
400	AttrMismatching.CidrProtocol	Attribute SrcCidr or DstCidr of TrafficMarkRule does not match Protocol.	Attribute SrcCidr or DstCidr of TrafficMarkRule does not match Protocol.
400	InvalidTransitRouterMode.NeedUpgrade	TransitRouter need to upgrade.	The error message returned because the specified transit router mode is not supported.
400	OperationUnsupported.DstPortRange	Current TR version does not support setting destination port range.	Current TR version does not support setting destination port range.
400	OperationUnsupported.SrcPortRange	Current TR version does not support setting source port range.	Current TR version does not support setting source port range
400	OperationUnsupported.IPv6Cidr	The traffic marking policy for current TR type does not support IPv6 CIDR.	The flow classification rules in the flow marking policy of the basic version forwarding router do not support IPv6 network segments.
400	IncorrectStatus.TransitRouterInstance	The status of TransitRouter is incorrect.	The error message returned because the transit router is in an invalid state.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.
400	MissingParam.TransitRouterId	The parameter TransitrouterId is mandatory.	The error message returned because the TransitRouterId parameter is not set.
400	OperationUnsupported.TransitRouterType	The specified TransitRouterType does not support the operation.	The error message returned because this operation is not supported by the specified type of transit router.
400	InvalidParameter.TransitRouterId	The specified parameter TransitRouterId is invalid.	The parameter TransitRouterId entered is illegal.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.