Can NOT match ACL in an output policy-map

Question

this it my config ,

access-list 2000 permit ip 8.8.8.0 0.0.0.255 any
access-list 2000 permit ip 8.34.208.0 0.0.15.255 any
access-list 2000 permit ip 8.35.192.0 0.0.15.255 any
access-list 2000 permit ip 23.236.48.0 0.0.15.255 any
access-list 2000 permit ip 35.240.0.0 0.7.255.255 any
access-list 2000 permit ip 64.9.224.0 0.0.1.255 any
access-list 2000 permit ip 64.9.228.0 0.0.1.255 any
access-list 2000 permit ip 64.15.112.0 0.0.15.255 any
access-list 2000 permit ip 64.233.160.0 0.0.31.255 any


class-map match-any google-traffic
 match access-group 2000
!         
policy-map 528
 class class-default
  shape average 3200000000 

interface TenGigabitEthernet0/0/1
 description Cust-1
 no ip address          
 service instance 528 ethernet
  description Ramy
  encapsulation dot1q 528
  rewrite ingress tag pop 1 symmetric
  service-policy output 528
  bridge-domain 528
 !        
! 

now everything is ok

i need use class google-traffic on my policy 528 i get error

FiberISP-Cisco(config)#policy-map 528
FiberISP-Cisco(config-pmap)#class google-traffic
QoS: Configuration failed. Can NOT match ACL in an output policy-map

Answer 1

For your ASR 903, using ACLs is restricted to ingress policies. See Quality of Service Configuration Guidelines for Cisco ASR 900 Router Series:

QoS ACLs are supported only for ingress traffic

You can create an ingress policy to either police or mark the traffic matching the ACL, then, if marked, you can shape or police on egress. You may simply want to police the incoming traffic, then you do not need to route/switch it unnecessarily before dropping it at the egress.

---

Edit:

If you know the address(es) or network(s) for your customer, the best use of your router's resources is to tackle the problem at the ingress interface by policing the traffic to the desired rate. This will only affect traffic from your Google addresses destined to your customer's address(es)/network(s):

access-list 2000 permit ip 8.8.8.0 0.0.0.255 <customer network> <customer wildcard>
access-list 2000 permit ip 8.34.208.0 0.0.15.255 <customer network> <customer wildcard>
access-list 2000 permit ip 8.35.192.0 0.0.15.255 <customer network> <customer wildcard>
access-list 2000 permit ip 23.236.48.0 0.0.15.255 <customer network> <customer wildcard>
access-list 2000 permit ip 35.240.0.0 0.7.255.255 <customer network> <customer wildcard>
access-list 2000 permit ip 64.9.224.0 0.0.1.255 <customer network> <customer wildcard>
access-list 2000 permit ip 64.9.228.0 0.0.1.255 <customer network> <customer wildcard>
access-list 2000 permit ip 64.15.112.0 0.0.15.255 <customer network> <customer wildcard>
access-list 2000 permit ip 64.233.160.0 0.0.31.255 <customer network> <customer wildcard>
!
class-map match-any From_Google_to_Customer_X
 match access-group 2000
!         
policy-map From_Google_to_Customer_X
 class From_Google_to_Customer_X
  police 8000 1000 1000 conform-action transmit exceed-action set-qos-transmit 1 violate-action drop
!
interface <input interface>
 service policy input From_Google_to_Customer_X
!

You can change the network(s), values, and actions to fit your particular situation. You have not provided enough information in your question to give you a good example.

Remember that things that have both source and destination addresses, like extended ACLs, should be applied as close to the source as possible in order to avoid unnecessarily routing traffic that is destined to be dropped, which will waste router resources.

Answer 2

i find a success method to policy a traffic of Specify ip's or else on CISCO ASR 903 IOS XE 3.18S

for example i have ip's 74.0.0.0/8 for some serivce (Like google)

1-subnet a full range from 1.0.0.0/8 to 255.0.0.0/8 and Cust your ip('s) you want enter link description here

2-now you have two range

1.0.0.0/8   
2.0.0.0/7
4.0.0.0/6   
8.0.0.0/5   
16.0.0.0/4  
32.0.0.0/3  
64.0.0.0/5  
72.0.0.0/8
74.0.0.0/8  (this we need to policy )
75.0.0.0/8
75.0.0.0/8  
76.0.0.0/6  
80.0.0.0/4
96.0.0.0/3  
128.0.0.0/1

3- Create To object group

#object-group network object_ip_select
      74.0.0.0/8 




 #object-group network object_ip_other
            1.0.0.0/8   
            2.0.0.0/7
            4.0.0.0/6   
            8.0.0.0/5   
            16.0.0.0/4  
            32.0.0.0/3  
            64.0.0.0/5  
            72.0.0.0/
            75.0.0.0/8
            75.0.0.0/8  
            76.0.0.0/6  
            80.0.0.0/4
            96.0.0.0/3  
            128.0.0.0/1

4-Create access-list for Cust and select a dst-address as Cust ip's

#ip access-list extended ACL-CUST1-IP-SELECT
 #permit ip object-group object_ip_select <CUSTNETWORK> <WILDCARD>

#ip access-list extended ACL-CUST1-IP-OTHER
 #permit ip object-group object_ip_other <CUSTNETWORK> <WILDCARD>

5-Create two policy-map for ip-select and other ips

 #class-map match-all CLASS-CUST1-IP-SELECT
 #match access-group name ACL-CUST1-IP-SELECT


 #class-map match-all CLASS-CUST1-IP-OTHER
 #match access-group name ACL-CUST1-IP-OTHER

6-Create Policy-map to our CLASS-MAP

policy-map TRAFFIC-LIMTED
 class CLASS-CUST1-IP-SELECT
  police cir 40M
 class CLASS-CUST1-IP-OTHER
  police cir 90M

7-apply this policy map to incoming interfcae or instance(vlan)

interface Port-channel2
 service instance 2000 ethernet
  service-policy input TRAFFIC-LIMTED

8- it's done now cust 1 has traffic 40 M for 74.0.0.0/8 and other 90M if you have more one cust just create another ip access list with ACL, CLASS, Then add the new class to policy-map TRAFFIC-LIMTED