3650 QoS ingress marking not working?

[Larry Sullivan]

Hi,

I'm trying to add CoS classification to traffic coming in from access ports that are on vlan 2551.  I did a match any with VLANs and access-group match statements to see if I got any hits.  The policy-map stats for the example interface are below.  I'm not getting any matches on the specific match vlans or access-groups although I am getting hits under the general policy-map.  Does this mean the packets aren't having CoS 4 added to them?  I'm working remote right now so can't wireshark this.  Why am I not getting any access-group or VLAN matches?  Is it because the packet comes in with no VLAN tag?  How about the access-group?  What can I do to classify packets coming in on a specific access-port to CoS 4?  Thank you.

class-map match-any VIDEO
match vlan 2551
match vlan 2548
match access-group 51
match access-group 48
class-map match-any non-client-nrt-class

policy-map VIDEO
class VIDEO
set cos 4

example interface:

int g1/0/15

service-policy input VIDEO

#s policy-map int g1/0/15
GigabitEthernet1/0/15

Service-policy input: VIDEO

Class-map: VIDEO (match-any)
2211246 packets
Match: vlan 2551
0 packets, 0 bytes
5 minute rate 0 bps
Match: vlan 2548
0 packets, 0 bytes
5 minute rate 0 bps
Match: access-group 51
0 packets, 0 bytes
5 minute rate 0 bps
Match: access-group 48
0 packets, 0 bytes
5 minute rate 0 bps
QoS Set
cos 4

[Francesco Molino]

Hi

Have you tried capturing the packets to see if tag is there?

Don't always rely on show qos output commands as they might not tell you all information.

[Larry Sullivan]

OK, so CLI Analyzer worked for setting up packet captures.  The weird thing is after the capture was stopped and decoded it would say 0 packets captured although I could see the coded hex dumps on the CLI itself.  So I took one of those and put it on a notepad saved and imported that into Wireshark and it's definitely not adding CoS.  Because it's an access port it's not being tagged so can't be matched on VLAN.  But that doesn't explain why the match access-group isn't working. Even tried a 0.0.0.0 255.255.255.255 ACL, still no matches.