Configure DSCP Settings on 2960XR and 3560C

[schwarz-michael]

Hello,

to get priority of some business applications at the MPLS WAN network I tried to configure DSCP settings (set ip dscp af31) at the routing devices in direction to the ISP MPLS routers of our departments. At the local site I have two WS-C2960XR VPN routerswitch for the MPLS premium connection, at the remote site there is installed a WS-C3560C routerswitch.  

At all locations I have configured:

class-map match-any Advanced-AF31_in
 match access-group name Advanced-AF31
!
policy-map set-DSCP-AF31
 class Advanced-AF31_in
  set ip dscp af31

!

interface Vlan x
 service-policy input set-DSCP-AF31

!

ip access-list extended Advanced-AF31

.....

The problem is that one of the WS-C2960XR routerswitch the "access-list" get hits and also the "policy-map interface vlan x" get hits, but at the second routerswitch WS-C2960XR with the same IOS and qos configuration the "access-list" and "policy-map interface vlan x" get no hits also the routerswitch WSC3560C at the remote site. The only difference of the routerswitch configuration is that the Uplink ports of the routerswitch with hit counts are "access-ports" and the uplink-ports of the routerswitches with no hit counts are "trunk-ports". But at all routers I have configured the "service-policy input set-DSCP-AF3" at the input vlan interface from the LAN of the routerswitch.

Do anybody have a hint to solve the problem of set DSCP

Thank so lot.  

[lpassmore]

It appears from your description that there are two 2960 switches that are connected via a trunk interface. A device is connected to switch 1 and the you are seeing packets that match the QoS policy on that device's input interface.  Between Switch 1 and switch 2 there is a trunk interface.  On the incoming trunk interface on Switch 2, the same QoS policy shows no matches.  

First of all I would not be rechecking and resetting the packets on Switch 2 as they enter from Switch 1 (maybe you are not doing that).

But you do need a command on both switches' trunk link that will trust the incoming DSCP value because, depending upon the IOS version I think, the default state is to reset the COS to 0.  In Ver 15, this is "mls qos trust dscp"

Assuming you have a separate router at each site, this command should also be on the interface to the site router so that incoming packets are not reset.  You will also need to set this on the 3560 switch interface which connects to that site's router.  

If the sites are directly connected via the switches (i.e. no router), put this command on the connection interface of both switches.

If this doesn't help, post the configurations, a diagram and the results of the show policy-map interface commands