2

i have cisco asr 903 (ios xe) i need to limitation Traffic for google-traffic this my configuration

ip access-list extended ip-google-traffic
 permit ip 8.8.4.0 0.0.0.255 any
 permit ip 8.8.8.0 0.0.0.255 any
 permit ip 8.34.208.0 0.0.15.255 any
 permit ip 8.35.192.0 0.0.15.255 any
 permit ip 23.236.48.0 0.0.15.255 any
 permit ip 23.251.128.0 0.0.31.255 any
 permit ip 35.184.0.0 0.7.255.255 any
 permit ip 35.192.0.0 0.7.255.255 any
 permit ip 35.200.0.0 0.3.255.255 any
 permit ip 35.204.0.0 0.1.255.255 any
 permit ip 35.224.0.0 0.15.255.255 any
 permit ip 35.240.0.0 0.7.255.255 any

class-map match-all google
 match access-group name ip-google-traffic
class-map match-all GGC-OUT
 match dscp af22
!
policy-map google-cap
 class google
  set ip dscp af22
policy-map Softlink
 class GGC-OUT
  police cir 5000000000
 class class-default
  police cir 1750000000 
INTERFACE TEN 0/0/3
service instance 2528 ethernet
  encapsulation dot1q 2528
  rewrite ingress tag pop 1 symmetric
  service-policy input google-cap
  bridge-domain 2528
 !

now when trying applying a policy for instance of my cusutmer i get msg error

INTERFACE TEN 0/0/3
FiberISP-Cisco(config-if-srv)#service instance 2528 ethernet
FiberISP-Cisco(config-if-srv)#service-policy out Cust
Match DSCP in IPv4/IPv6 packets is not supported for this interfac
 !

WHY?

  • I believe that only works for layer-3 interfaces. – Ron Maupin Jun 26 '18 at 20:50
  • Any idea for limitation??? – Anas Programmer Jun 26 '18 at 21:02
  • 1
    DSCP would be part of the IP header as such is processed by layer-3 interfaces. As you have an L2 Ethernet interface you should use CoS to classify your traffic as it doesn't care about nor can it manipulate the IP header. – A-A-Ron Jun 26 '18 at 21:03
  • Thanks for reply, do you have any idea by example ?? – Anas Programmer Jun 26 '18 at 21:04
  • Have you looked at NBAR2? Trying to mark all the different Google IP addresses will be hard to maintain, as things change all the time. – Ron Maupin Jun 26 '18 at 21:12
2

i find a success method to policy a traffic of Specify ip's or else on CISCO ASR 903 IOS XE 3.18S

for example i have ip's 74.0.0.0/8 for some serivce (Like google)

1-subnet a full range from 1.0.0.0/8 to 255.0.0.0/8 and Cust your ip('s) you want enter link description here

2-now you have two range

1.0.0.0/8   
2.0.0.0/7
4.0.0.0/6   
8.0.0.0/5   
16.0.0.0/4  
32.0.0.0/3  
64.0.0.0/5  
72.0.0.0/8
74.0.0.0/8  (this we need to policy )
75.0.0.0/8
75.0.0.0/8  
76.0.0.0/6  
80.0.0.0/4
96.0.0.0/3  
128.0.0.0/1

3- Create To object group

#object-group network object_ip_select
      74.0.0.0/8 




 #object-group network object_ip_other
            1.0.0.0/8   
            2.0.0.0/7
            4.0.0.0/6   
            8.0.0.0/5   
            16.0.0.0/4  
            32.0.0.0/3  
            64.0.0.0/5  
            72.0.0.0/
            75.0.0.0/8
            75.0.0.0/8  
            76.0.0.0/6  
            80.0.0.0/4
            96.0.0.0/3  
            128.0.0.0/1

4-Create access-list for Cust and select a dst-address as Cust ip's

#ip access-list extended ACL-CUST1-IP-SELECT
 #permit ip object-group object_ip_select <CUSTNETWORK> <WILDCARD>

#ip access-list extended ACL-CUST1-IP-OTHER
 #permit ip object-group object_ip_other <CUSTNETWORK> <WILDCARD>

5-Create two policy-map for ip-select and other ips

 #class-map match-all CLASS-CUST1-IP-SELECT
 #match access-group name ACL-CUST1-IP-SELECT


 #class-map match-all CLASS-CUST1-IP-OTHER
 #match access-group name ACL-CUST1-IP-OTHER

6-Create Policy-map to our CLASS-MAP

policy-map TRAFFIC-LIMTED
 class CLASS-CUST1-IP-SELECT
  police cir 40M
 class CLASS-CUST1-IP-OTHER
  police cir 90M

7-apply this policy map to incoming interfcae or instance(vlan)

interface Port-channel2
 service instance 2000 ethernet
  service-policy input TRAFFIC-LIMTED

8- it's done now cust 1 has traffic 40 M for 74.0.0.0/8 and other 90M if you have more one cust just create another ip access list with ACL, CLASS, Then add the new class to policy-map TRAFFIC-LIMTED

1

DSCP would be part of the IP header as such is processed by layer-3 interfaces. As you have an L2 Ethernet interface you should use CoS to classify your traffic as it doesn't care about nor can it manipulate the IP header.

This document will give you a good overview of how to use CoS in your class-maps and policy-maps.

Based on your provided config it would be something like this.

class-map match-all GGC-OUT
match cos 3
!
policy-map google-cap
 class google
  set cos 3
  • Cisco also has QoS document specific to the ASR903:, e.g. Quality of Service Configuration Guidelines for Cisco ASR 900 Router Series. – Ron Maupin Jun 26 '18 at 21:27
  • Same old error QoS: Configuration failed. Can NOT match ACL in an output policy-map – Anas Programmer Jun 26 '18 at 21:32
  • That's not the same error, it just appears to be the next hurdle after resolving the first one. You can use the ACL to mark google traffic on input of your external facing interface, then use that marking to match and police on the output policy to the customer. – A-A-Ron Jun 26 '18 at 22:11
  • Match named access-list is not supported for this interface – Anas Programmer Jun 27 '18 at 10:08
  • Are you trying to apply it to an L3 or L2 interface? Have you had a chance to read the documents that were linked above? Also it would be helpful to have a full config and a more detailed description of what was applied where in the config to really understand and provide helpful feedback. – A-A-Ron Jun 27 '18 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.