Hello all,
I'm trying to implement service policy on our ipsec tunnels on ASR1001. Version: asr1001-universalk9.03.13.01.S.154-3.S1-ext.bin
Here is the typical Tunnel configuration:
interface Tunnel100
ip address 172.x.x.x 255.255.255.252
ip mtu 1450
ip access-group ACL_IN in
ip access-group ACL_OUT out
ip policy route-map ForwardIP
ip ospf network point-to-point
ip ospf mtu-ignore
ip ospf cost 40
qos pre-classify
tunnel source ZZ.ZZ.ZZ.ZZ
tunnel mode ipip
tunnel destination YY.YY.YY.YY
tunnel protection ipsec profile IPSec-AES
service-policy input Tunnel_IN
When I try to add an output service-policy on that interface, I get an error:
(nbar): (err): NBAR is not supported on Tunnel10042
If I try to enable ip nbar protocol-discovery, I get an error:
% NBAR Error: Can not enable Protocol-discovery NBAR is not supported on this interface
Is it possible to use NBAR on that interface?
