Traffic marking is not working properly in QoS

Question

Traffic marking is not working properly in QoS.

I have a problem with the policy map marking bit. I would like to monitor the traffic that matches the IP precedence bit 4 in Po 50, but from the following configuration, The traffic that shows by show policy-map interface port-channel 50 output class AllBit4 isn't correct.

If the condition matches the class-map Shape_A before class-map AllBit4, does policy-map Traffic_Out do only the police action in class-map Shape_A?

If yes, how can I do the police action in class-map Shape_A and set the precedence bit 4 in class-map AllBit4 in the same policy-map?

Configuration:

Router#show policy-map Traffic_Out

  Policy Map Traffic_Out

    Class Shape_A
     police cir 5000000000 bc 156250000 be 156250000
       conform-action transmit 
       exceed-action transmit 
       violate-action transmit 
    Class Shape_B
     police cir 5000000000 bc 156250000 be 156250000
       conform-action transmit 
       exceed-action transmit 
       violate-action transmit 
    Class AllBit4
      set precedence 4


Router#show class-map Shape_A
 Class Map match-all Shape_A (id 36)
   Match access-group name Shape_A

Router#show ip access-lists Shape_A
Extended IP access list Shape_A
    10 deny icmp any any
    20 permit ip any 10.0.0.0 0.0.0.255 precedence flash-override

Router#show class-map Shape_B
 Class Map match-all Shape_B (id 37)
   Match access-group name Shape_B

Router#show ip access-lists Shape_B
Extended IP access list Shape_B
    10 deny icmp any any
    20 permit ip any 172.16.0.0 0.0.255.255 precedence flash-override

Router#show class-map AllBit4
 Class Map match-all AllBit4 (id 54)
   Match access-group name AllBit4

Router#show ip access-lists AllBit4
Extended IP access list AllBit4
    10 permit ip any any precedence flash-override

interface Port-channel50
 ip address x.x.x.x x.x.x.x
 service-policy output Traffic_Out

end

Answer 1

Your policy map will work like an access list. It evaluates traffic in a top-down manner until it gets a match, then it will exit the policy map.

Depending on the IOS version, you can nest class maps. You can try something like this (disclaimer: this has not been tested, and I did it from memory, so you may need to adjust it):

class-map match-all AllBit4
  match ip precedence flash-override
!
ip access-list extended Shape_A
 deny icmp any any
 permit ip any 10.0.0.0 0.0.0.255
!
ip access-list extended Shape_B
 deny icmp any any
 permit ip any 172.16.0.0 0.0.255.255
!
class-map match-all Shape_A
  match access-group name Shape_A
  match class-map AllBit4
!
class-map match-all Shape_B
  match access-group name Shape_B
  match class-map AllBit4
!

Notice that you do not need an access list to match the precedence in class-map AllBit4, and since you are nesting the precedence match with a match-all in class-map Shape_A and class-map Shape_B, you do not need to include the precedence in the access lists for the other class maps.

This will force class-map Shape_A and class-map Shape_B to match both the access lists defining the address range, and the IP precedence, much like you have in the original access lists, but using class-map AllBit4 to match the precedence instead of including it in the access lists.