It is very hard to find information on this topic. I would like to know: If traffic has a hit inside a class-map, is it immediately forwarded or does it get checked against all remaining match statements first? Example: given following configuration:
ip access-list extended QOS_CITRIX
permit tcp any eq 2598 any
permit tcp any any eq 2598
permit udp any eq 2598 any
permit udp any any eq 2598
class-map match-any QOS_CITRIX
match ip dscp 32
match access-group name QOS_CITRIX
policy-map QOS
class QOS_CITRIX
set dscp 32
bandwidth percent 50
If a packet with DSCP32 arrives to be checked against this class-map, does it process the ACL?
match <protocol>
XORmatch access-group <someACL>
. You can have multiple statements (elsematch-any
wouldn't be very useful) of either but not both. On the other hand, nothing stops you from defining two class-maps (one matching on protocol, the other matching on ACL), and then making use of both in the policy map, applying the same set of actions to them. – Marc 'netztier' Luethi Apr 1 at 13:53set dscp 32
) is typically something done on the ingress interface (service policy input ..
) of a device, while applying something from the shaping/policing/queuing toolset (bandwidth percent 50
) is meant for an egress interface of a device (service policy output ...
). Many devices/Platforms won't even let you rewrite DSCP on the egress side. – Marc 'netztier' Luethi Apr 1 at 14:02