I have some ME3800's running 15.3(3)S which aggregate layer 2 circuits from customers. They all have a similar configuration of an incoming trunk on Gi0/1 and then Gi0/23 & Gi0/24 are layer 3 p-t-p links to neighbouring ME3x00 switches;

gi0/23--SW1---gi0/23     gi0/24---SW2---gi0/23     gi0/24---SW3---gi0/23     
         |                         |                         |
         |                         |                         |
       gi0/1                    gi0/1                      gi0/1

I am trying to apply some QoS on this network. I can apply my policies to the L3 interfacings linking the switches together but I can't apply the same QoS policy to the L2 trunks.

SW1#show run int gi0/1
Building configuration...

Current configuration : 93 bytes
interface GigabitEthernet0/1
 description ****ACCESS-UPLINK****
 switchport mode trunk

The reason is because the QoS policies are written for layer 3 interfaces, when I try to apply them to this trunk interface I get the following error;

SW1(config-if)#service-policy input PE-QOS-OUT 
QoS: Configuration failed. 'match qos-group' not allowed in an input policy-map
QoS: Configuration failed. 'match qos-group' not allowed in an input policy-map
QoS: Configuration errors for policymap PE-QOS-OUT

I am wondering how I can write a policy for layer 2 trunk interfaces; I could apply the layer 3 policy map to each SVI on this switch that terminates each VLAN being trunked up but surely the QoS policy on an SVI doesn't look at the ingress/egress interface of a frame and examine the congestion for that interface? How coule the SVI policy manage the layer 2 turnk?

Short question: To QoS a layer 2 interface is the only (best?) way to break it down into service instances?

Long question: Would I have to convert those interfaces to use service instances and then add a service instance for each VLAN being trunked in; Then I could apply a parent policy to the interface which has various classes defined, each class matches one of the VLANs/service instances being trunked in and then apply the same child policy to each VLAN/service instace which would be the layer 3 one I originally tied to apply?

A snippest of the layer 3 policy I am using;

class-map match-any NC
 match mpls experimental topmost 6
 match mpls experimental topmost 7
 match dscp cs6
 match dscp cs7
 match cos 6
 match cos 7
class-map match-any REALTIME
 match mpls experimental topmost 5
 match dscp ef
 match dscp cs5
 match cos 5

class-map match-any NC-QG
 match qos-group 6
 match dscp cs6
 match dscp cs7
class-map match-any REALTIME-QG
 match qos-group 5

policy-map PE-QOS-IN
 class NC
  set qos-group 6
  set qos-group 5

policy-map PE-QOS-OUT
 class NC-QG
  bandwidth percent 2
  queue-limit 1024000 bytes
  police cir percent 10
   conform-action transmit
   exceed-action drop
  queue-limit 1024000 bytes
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8, 2017 at 21:04

1 Answer 1


It seems I knew the answer to my own question already essentially;

To aggregate layer 2 links and QoS them I must define the service insances to match each VLAN (rather than one VLAN per cusomer the same set of VLANs are being trunked down to all customers so they all fall under one class-map);

class-map match-any tripple-play
 match service instance ethernet  10
 match service instance ethernet  20
 match service instance ethernet  30

 class tripple-play
 service-policy PE-QOS-CPE-OUT

interface gi0/1
 switchport trunk allowed vlan none
 switchport mode trunk
 service-policy input PE-QOS-CPE-IN
 service-policy output PE-QOS-CPE-OUT-PARENT

 service instance 10 ethernet
   description voice
   encapsulation dot1q 10
   rewrite ingress tag pop 1 symmetric
   bridge-domain 10

 service instance 20 ethernet
   description video
   encapsulation dot1q 20
   rewrite ingress tag pop 1 symmetric
   bridge-domain 20

 service instance 30 ethernet
   description data
   encapsulation dot1q 30
   rewrite ingress tag pop 1 symmetric
   bridge-domain 30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.