5

Traffic marking is not working properly in QoS.

I have a problem with the policy map marking bit. I would like to monitor the traffic that matches the IP precedence bit 4 in Po 50, but from the following configuration, The traffic that shows by show policy-map interface port-channel 50 output class AllBit4 isn't correct.

If the condition matches the class-map Shape_A before class-map AllBit4, does policy-map Traffic_Out do only the police action in class-map Shape_A?

If yes, how can I do the police action in class-map Shape_A and set the precedence bit 4 in class-map AllBit4 in the same policy-map?

Configuration:

Router#show policy-map Traffic_Out

  Policy Map Traffic_Out

    Class Shape_A
     police cir 5000000000 bc 156250000 be 156250000
       conform-action transmit 
       exceed-action transmit 
       violate-action transmit 
    Class Shape_B
     police cir 5000000000 bc 156250000 be 156250000
       conform-action transmit 
       exceed-action transmit 
       violate-action transmit 
    Class AllBit4
      set precedence 4


Router#show class-map Shape_A
 Class Map match-all Shape_A (id 36)
   Match access-group name Shape_A

Router#show ip access-lists Shape_A
Extended IP access list Shape_A
    10 deny icmp any any
    20 permit ip any 10.0.0.0 0.0.0.255 precedence flash-override

Router#show class-map Shape_B
 Class Map match-all Shape_B (id 37)
   Match access-group name Shape_B

Router#show ip access-lists Shape_B
Extended IP access list Shape_B
    10 deny icmp any any
    20 permit ip any 172.16.0.0 0.0.255.255 precedence flash-override

Router#show class-map AllBit4
 Class Map match-all AllBit4 (id 54)
   Match access-group name AllBit4

Router#show ip access-lists AllBit4
Extended IP access list AllBit4
    10 permit ip any any precedence flash-override

interface Port-channel50
 ip address x.x.x.x x.x.x.x
 service-policy output Traffic_Out

end
2

1 Answer 1

1

Your policy map will work like an access list. It evaluates traffic in a top-down manner until it gets a match, then it will exit the policy map.

Depending on the IOS version, you can nest class maps. You can try something like this (disclaimer: this has not been tested, and I did it from memory, so you may need to adjust it):

class-map match-all AllBit4
  match ip precedence flash-override
!
ip access-list extended Shape_A
 deny icmp any any
 permit ip any 10.0.0.0 0.0.0.255
!
ip access-list extended Shape_B
 deny icmp any any
 permit ip any 172.16.0.0 0.0.255.255
!
class-map match-all Shape_A
  match access-group name Shape_A
  match class-map AllBit4
!
class-map match-all Shape_B
  match access-group name Shape_B
  match class-map AllBit4
!

Notice that you do not need an access list to match the precedence in class-map AllBit4, and since you are nesting the precedence match with a match-all in class-map Shape_A and class-map Shape_B, you do not need to include the precedence in the access lists for the other class maps.

This will force class-map Shape_A and class-map Shape_B to match both the access lists defining the address range, and the IP precedence, much like you have in the original access lists, but using class-map AllBit4 to match the precedence instead of including it in the access lists.

3
  • If i show class-map "AllBit4" on the interface. Is the traffic rate on this class-map is the sum of class-map AllBIt4 in Shape_A and class-map AllBit4 in Shape_B ? Jul 26, 2017 at 3:13
  • Yes. It should increment with each of the other two class maps. If you change the order of the match statements in the other two class maps to place it as the first match, it would increment for every match of the precedence, in some cases (first class map doesn't match all) twice
    – Ron Maupin
    Jul 26, 2017 at 3:17
  • Just curious, how did you validate it wasn't working? Just seeing what others do in these situations. Thank you.
    – Fixitrod
    Aug 24, 2017 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.