Doesn't work QOS on 4451-X

[Maxim Ototuk]

Hello, 

I have a problem:

class-map match-all HTTS
 match protocol http
 match protocol secure-http
!
policy-map QOS
 class HTTS
 priority percent 10
 class class-default
 random-detect
policy-map int
 class class-default
 shape average 10000000
 service-policy QOS

interface Tunnel1
 bandwidth 10000
 ip unnumbered Loopback9
 ip mtu 1300
 tunnel source a.b.c.d
 tunnel destination a.c.b.d
 service-policy output int

2016-03-17 15:45:01 local7.info  3883:  Service policy installation failed 

2016-03-17 15:45:01 local7.info  3882: Mar 17 15:45:01.683: %QOS-6-POLICY_INST_FAILED:

What am I doing wrong?

[Philip D'Ath]

Break it done into smaller chunks to find out which bit is breaking it.

Does just this work?

policy-map int
 class class-default
 shape average 10000000

[Maxim Ototuk]

It also don't work.

[Philip D'Ath]

So without a child policy it also fails?  What software version are you running?

[Philip D'Ath]

The current gold star releases for the 4451 are 3.16.2S and 3.13.5S.  If you aren't using one of them I would try changing to one of them first.

[Maxim Ototuk]

This time, I can't  download this image.

[Philip D'Ath]

You can only download the software if you have a Cisco maintenance contract.  Have you got a contract on the 4451?

[Maxim Ototuk]

policy-map int-2
 class class-default
 shape average 10000000

interface Tunnel1
 bandwidth 10000
 ip unnumbered Loopback9
 ip mtu 1300
 tunnel source a.b.c.d
 tunnel destination a.c.b.d
 service-policy output int-2

 It also don't work.

String don't save in running-config.

System image file is "bootflash:/isr4400-universalk9.03.13.02.S.154-3.S2-ext.SPA.bin"

Technology Package License Information:
-----------------------------------------------------------------
Technology Technology-package Technology-package
 Current Type Next reboot
------------------------------------------------------------------
appx      None       None None
uc        uck9       Permanent uck9
security  securityk9 Permanent securityk9
ipbase    ipbasek9   Permanent ipbasek9
cisco ISR4451-X/K9 (2RU) processor with 1687596K/6147K bytes of memory.
Processor board ID 
4 Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
7341807K bytes of flash memory at bootflash:.

[Philip D'Ath · Accepted solution]

Could you upgrade to 3.16.2S or 3.13.5S?  I think what you are doing should work.

[Maxim Ototuk]

On physical interface policy is working....

[Vasilii Mikhailovskii]

Hello.

Could you check "show ip cef ..." for tunnel destination and provide sh runn for the egress interface[s]?

If you have QoS on the interface[s], could you provide policy-map configuration?

PS: 

configuration

class-map match-all HTTS
 match protocol http
 match protocol secure-http

sounds a little strange to match both "http" and "secure-http".

[Maxim Ototuk]

interface Tunnel1
bandwidth 10000
 ip unnumbered Loopback9
 ip mtu 1300
 ip authentication mode eigrp 65040 md5
 ip authentication key-chain eigrp 65040 EIGRP-65040
 ip hello-interval eigrp 65040 3
 ip hold-time eigrp 65040 10
 ip tcp adjust-mss 1260
 keepalive 10 2
 tunnel source Port-channel1.305
 tunnel destination x.x.46.2

#sh ip cef x.x.46.2
x.x.46.2/32
 attached to Port-channel1.305

interface Port-channel1.305
encapsulation dot1Q 305
 ip address x.x.0.3 255.255.128.0

interface GigabitEthernet0/0/0
no ip address
 speed 1000
 no negotiation auto
 channel-group 1

interface GigabitEthernet0/0/2
no ip address
 speed 1000
 no negotiation auto
 channel-group 1

#sh ip eigrp neighbors Tunnel1
H          Address         Interface    Hold       Uptime      SRTT   RTO  Q Seq 
13    y.y.221.255            Tu1           9      21:38:30 31   186         0     233489

> sounds a little strange to match both "http" and "secure-http"

- Why?

class-map is more. I'm using it for checking.

[Vasilii Mikhailovskii · Accepted solution]

Hello.

Having QoS on Tunnel with port-channel as egress is not supported till XE 3.14 (CSCum12999).

[Maxim Ototuk]

Thanks.