1
object-group network ip-google
     8.8.4.0 255.255.255.0
     8.8.8.0 255.255.255.0
     8.34.208.0 255.255.240.0
     8.35.192.0 255.255.240.0
     23.236.48.0 255.255.240.0
     23.251.128.0 255.255.224.0
     35.184.0.0 255.248.0.0
     35.192.0.0 255.248.0.0
     35.200.0.0 255.252.0.0
     35.204.0.0 255.254.0.0
     35.224.0.0 255.240.0.0
     35.240.0.0 255.248.0.0
     64.9.224.0 255.255.254.0
     64.9.228.0 255.255.254.0
     64.15.112.0 255.255.240.0
     64.233.160.0 255.255.224.0
    .
    ip access-list extended ACL-ANAS
    Deny ip object-group ip-google 91.192.4.12 0.0.0.3

    class-map match-all CLASS-ANAS
     match access-group name ACL-ANAS
    !
    policy-map MT-LIMTED
     class CLASS-ANAS
      police 2000000



FiberISP-Cisco(config-if)#interface ten 0/0/0
FiberISP-Cisco(config-if)#service instance 2528 ethernet
FiberISP-Cisco(config-if-srv)#service-policy input MT-LIMTED
**QoS: Configuration failed. deny is not supported
QoS: Configuration failed. deny is not supported
QoS: Configuration errors for policymap MT-LIMTED**
  • 1
    OK. Do you have a question? The logic of that configuration is wrong because you will never match anything. You must give it something to match. – Ron Maupin Jun 30 '18 at 18:23
  • if i make my access-list " permit " i can policy all ips with source google-ip and dst-ip csut , but i need to make else this ACL – Anas Programmer Jun 30 '18 at 18:25
  • 1
    That makes no sense. You are saying that you want to deny the range, but there is no range to match when you try to match. A match is a permit not a deny. I think you really need to edit your question to give a full explanation of what you want to accomplish. You may be focusing on the perceived solution rather than the actual problem (X-Y problem). – Ron Maupin Jun 30 '18 at 18:29
  • bro , i need condition say " when source is not "Google-ip" and destination is <Ip network Cust > , so policy this class for example100M – Anas Programmer Jun 30 '18 at 18:40
  • 1
    We have Network Engineering Chat, but I'm trying to do some other stuff right now. We have people who check it. – Ron Maupin Jun 30 '18 at 18:58
2

i find a success method to policy a traffic of Specify ip's or else on CISCO ASR 903 IOS XE 3.18S

for example i have ip's 74.0.0.0/8 for some serivce (Like google)

1-subnet a full range from 1.0.0.0/8 to 255.0.0.0/8 and Cust your ip('s) you want enter link description here

2-now you have two range

1.0.0.0/8   
2.0.0.0/7
4.0.0.0/6   
8.0.0.0/5   
16.0.0.0/4  
32.0.0.0/3  
64.0.0.0/5  
72.0.0.0/8
74.0.0.0/8  (this we need to policy )
75.0.0.0/8
75.0.0.0/8  
76.0.0.0/6  
80.0.0.0/4
96.0.0.0/3  
128.0.0.0/1

3- Create To object group

#object-group network object_ip_select
      74.0.0.0/8 




 #object-group network object_ip_other
            1.0.0.0/8   
            2.0.0.0/7
            4.0.0.0/6   
            8.0.0.0/5   
            16.0.0.0/4  
            32.0.0.0/3  
            64.0.0.0/5  
            72.0.0.0/
            75.0.0.0/8
            75.0.0.0/8  
            76.0.0.0/6  
            80.0.0.0/4
            96.0.0.0/3  
            128.0.0.0/1

4-Create access-list for Cust and select a dst-address as Cust ip's

#ip access-list extended ACL-CUST1-IP-SELECT
 #permit ip object-group object_ip_select <CUSTNETWORK> <WILDCARD>

#ip access-list extended ACL-CUST1-IP-OTHER
 #permit ip object-group object_ip_other <CUSTNETWORK> <WILDCARD>

5-Create two policy-map for ip-select and other ips

 #class-map match-all CLASS-CUST1-IP-SELECT
 #match access-group name ACL-CUST1-IP-SELECT


 #class-map match-all CLASS-CUST1-IP-OTHER
 #match access-group name ACL-CUST1-IP-OTHER

6-Create Policy-map to our CLASS-MAP

policy-map TRAFFIC-LIMTED
 class CLASS-CUST1-IP-SELECT
  police cir 40M
 class CLASS-CUST1-IP-OTHER
  police cir 90M

7-apply this policy map to incoming interfcae or instance(vlan)

interface Port-channel2
 service instance 2000 ethernet
  service-policy input TRAFFIC-LIMTED

8- it's done now cust 1 has traffic 40 M for 74.0.0.0/8 and other 90M if you have more one cust just create another ip access list with ACL, CLASS, Then add the new class to policy-map TRAFFIC-LIMTED

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.