Match cos is not supported for this interface in the output direction

Question

I Have ROUTER CISCO ASR 903 ( IOS XE V3.18 )

  ip access-list extended ip-google-traffic
 permit ip 8.8.4.0 0.0.0.255 any
 permit ip 8.8.8.0 0.0.0.255 any
 permit ip 8.34.208.0 0.0.15.255 any
 permit ip 8.35.192.0 0.0.15.255 any
 permit ip 23.236.48.0 0.0.15.255 any
 permit ip 23.251.128.0 0.0.31.255 any
 permit ip 35.184.0.0 0.7.255.255 any
 permit ip 35.192.0.0 0.7.255.255 any
 permit ip 35.200.0.0 0.3.255.255 any
 permit ip 35.204.0.0 0.1.255.255 any
 permit ip 35.224.0.0 0.15.255.255 any
 permit ip 35.240.0.0 0.7.255.255 any
 permit ip 64.9.224.0 0.0.1.255 any
 permit ip 64.9.228.0 0.0.1.255 any
 permit ip 64.15.112.0 0.0.15.255 any
 permit ip 64.233.160.0 0.0.31.255 any
 permit ip 66.102.0.0 0.0.15.255 any
 permit ip 66.249.64.0 0.0.31.255 any

** i match all traffic on vlan 2528 with ACL IP-GOOGLE-TRAFFIC

 class-map match-all google
 match access-group name ip-google-traffic



  policy-map google-cap
     class google
     set cos 3


interface Port-channel2
 description To-MTS-BE02
 mtu 9000
 no ip address
 service instance 2528 ethernet
  encapsulation dot1q 2528
  rewrite ingress tag pop 1 symmetric
  service-policy input google-cap
  bridge-domain 2528
 !
 service instance 2529 ethernet
 !
!

** Now i have CUST on interface 0/0/2 with instance 955 , i need make a limited traffic for google and default

 class-map match-all GGC-OUT
   match cos  3
   !


policy-map Cust1
 class GGC-OUT
  police cir 5000000000
 class class-default
  police cir 1750000000
!
!

** Now applying A policy to Cust1 instance

#interface ten 0/0/6
#service instance 955 ethernet 
serivce-policy output Cust1

i get this msg error Match cos is not supported for this interface in the output direction. or if i used DSCP i get this msg Match DSCP in IPv4/IPv6 packets is not supported for this interface

so any idean to limited a google and default traffic for my Customers on ASR 903

Answer 1

i find a success method to policy a traffic of Specify ip's or else on CISCO ASR 903 IOS XE 3.18S

for example i have ip's 74.0.0.0/8 for some serivce (Like google)

1-subnet a full range from 1.0.0.0/8 to 255.0.0.0/8 and Cust your ip('s) you want enter link description here

2-now you have two range

1.0.0.0/8   
2.0.0.0/7
4.0.0.0/6   
8.0.0.0/5   
16.0.0.0/4  
32.0.0.0/3  
64.0.0.0/5  
72.0.0.0/8
74.0.0.0/8  (this we need to policy )
75.0.0.0/8
75.0.0.0/8  
76.0.0.0/6  
80.0.0.0/4
96.0.0.0/3  
128.0.0.0/1

3- Create To object group

#object-group network object_ip_select
      74.0.0.0/8 




 #object-group network object_ip_other
            1.0.0.0/8   
            2.0.0.0/7
            4.0.0.0/6   
            8.0.0.0/5   
            16.0.0.0/4  
            32.0.0.0/3  
            64.0.0.0/5  
            72.0.0.0/
            75.0.0.0/8
            75.0.0.0/8  
            76.0.0.0/6  
            80.0.0.0/4
            96.0.0.0/3  
            128.0.0.0/1

4-Create access-list for Cust and select a dst-address as Cust ip's

#ip access-list extended ACL-CUST1-IP-SELECT
 #permit ip object-group object_ip_select <CUSTNETWORK> <WILDCARD>

#ip access-list extended ACL-CUST1-IP-OTHER
 #permit ip object-group object_ip_other <CUSTNETWORK> <WILDCARD>

5-Create two policy-map for ip-select and other ips

 #class-map match-all CLASS-CUST1-IP-SELECT
 #match access-group name ACL-CUST1-IP-SELECT


 #class-map match-all CLASS-CUST1-IP-OTHER
 #match access-group name ACL-CUST1-IP-OTHER

6-Create Policy-map to our CLASS-MAP

policy-map TRAFFIC-LIMTED
 class CLASS-CUST1-IP-SELECT
  police cir 40M
 class CLASS-CUST1-IP-OTHER
  police cir 90M

7-apply this policy map to incoming interfcae or instance(vlan)

interface Port-channel2
 service instance 2000 ethernet
  service-policy input TRAFFIC-LIMTED

8- it's done now cust 1 has traffic 40 M for 74.0.0.0/8 and other 90M if you have more one cust just create another ip access list with ACL, CLASS, Then add the new class to policy-map TRAFFIC-LIMTED