MARKING A TRAFFIC WITH AF31

[dawitassefa]

Hello ,

    I have a Cisco 3725 router with IOS version "Cisco IOS Software, 3700 Software (C3725-ADVIPSERVICESK9-M), Version 12.4(12)". And this router is serving as a CE route for our MPLS connection to the service Provider. We do also have multiple VRFs ( around 10) and the WAN interface is DS3. So we created point-to-point subinterfaces and we put them in different vrfs. We have now transitioned to a new ISP and the ISP requested us to mark all of our outgoing traffics with DSCP AF31. So I have created the following policy-map

policy-map TRAFFIC-OUT-WAN-AF31

class TRAFFIC-OUT-WAN

  set ip dscp af31

class-map match-any TRAFFIC-OUT-WAN

match any

Now we do have multiple GRE tunnel interfaces sourced from one of the WAN subinterface ( which is a member of VRF A). So the moment I applied the the policy-map  on this WAN sub-interface (using the syntax "service-policy out TRAFFIC-OUT-WAN-AF31"), most of the GRE tunnels went down. And there is eBGP running on top of these GRE tunnels. Any idea please?

Thanks,

[dgroscost]

Have you tried applying the service policy to the physical interface?

[Tagir Temirgaliyev]

Hi

try different labeling

policy-map TRAFFIC-OUT-WAN-AF31

class TRAFFIC-OUT-WAN

  set ip dscp af31                                                              -------- here try another  labeling

class-map match-any TRAFFIC-OUT-WAN

match any

Ask your provider how they are transmiting/dropping packets of different labeling

[dawitassefa]

Hello,

  dgroscost:  Yes I have tried to apply the policy-map on the physical interface. It will just bring down some of the GRE tunnel interfaces.

ttemirgaliyev:

What do you mean by different labeling? Can you please further elaborate your idea with an example?

I thank you guys for all of your support

[cflory]

Did your CPU spike at all when you enabled the service policy statement?  I've seen this in the past before as a bug, but perhaps not in this instance.

[dawitassefa]

I did NOT checked that though! But I belive it might be a bug as the IOS is a bit old . The funny part is that some of the GRE tunnels are up and the BGP established on top of these GRE tunnels. But majority of the tunnels are down. I might have to open a ticket with CIsco...I will advice you my findings.