match-any vs match-all use case

[nwekechampion]

Hi guys,

Can anyone tell me when I would need to use the

match-any or match-all use case in a class-map

to classify traffic?

I understand the below application:

any ==> or ( choose any that mathces)

all ==> and (must match all)

Regards

Champ

[David Ruess]

Hello,

It will basically boil down to the requirements of what you need it for. As you stated you understand the AND/OR operation of the ANY/ALL statement. 

For example lets say you have traffic from

network 172.16.1.0/24

Voice traffic is tagged with DSCP value of 46. You can set a

class map

to match an IP ACL that has the

172.16.1.0/24 network

statement. Then you can configure it like the below example:

ip access-list standard LAN
permit 172.16.1.0 0.0.0.255

class-map match-all TEST
match access-group name LAN
match dscp 46

^this will match any packet in

network 172.16.1.0/24

WITH a DSCP value of 46. Other packets will not be caught by this. If you didn't have the match-all and it was match-any then it would hit on packets in the entire

172.16.1.0/24

range regardless of their DSCP value. It would also hit on any packet with a DSCP value of 46 regardless of what network it was coming from sinc the match any means it can match any statement in the

class-map

-David

[nwekechampion]

Hi David,

Thank you.

Makes sense.

But could you maybe expand on the below, please?

If you didn't have the

match-all

and it was

match-any

then it would hit on packets in the entire

172.16.1.0/24

range regardless of their DSCP value. It would also hit on any packet with a DSCP value of 46 regardless of what network it was coming from since the match any means it can match any statement in the

class-map

This seems rather counter-intuitive giving the name

match-all/match-any

Basically:

match-all

==> More specific to marking?

Match-any

==> matches whole subnet in ACL - regardless of marking?

So, given the above, if I chose  "äny", why would I need the dscp marking as it will just match all packets regardless?

Also I am guessing I would not need the

access-list

too?

Sorry if this is a noob question.. Qos does my head in.

Thanks

Champ

[David Ruess · Accepted solution]

You're fine. QoS does a number on me too (I just reviewed it...again).

Dont think of my examples as set in stone. The match any/all statements can refer to anything, not just ACLs and DSCP marking.

@Joseph W. Doherty  also provided a good example. Lets use it in 2 examples:

class-map match-any TEST
match ip dscp CS3
match ip dscp AF31
match ip dscp AF32
match ip dscp AF33

The

MATCH-ANY

means any packet with any ONE (or more) of these marking will be matched. Now lets try the other one:

class-map match-all TEST
match ip dscp CS3
match ip dscp AF31
match ip dscp AF32
match ip dscp AF33

The

MATCH-ALL

says the packet must contain ALL of the DSCP values in order for the policy to hit.

You can match on lots of other things as well. Here another good example. You can match on routing protocols as well like OSPF or EIGRP. Another great example of match any or all. You may have 2 routing protocols running on a router OSPF/EIGRP being redistributed into each other. Now we know the packet coming into the router CANNOT have both the OSPF and EIGRP information in the SAME packet. They are separate protocols. So lets look at the below scenario:

ip access-list extended EIGRP
permit eigrp any any

ip access-list extended OSPF
permit ospf any any

First we caret 2

access-lists

to identify the routing protocol traffic. Then we apply it to the

class-map

class-map match-all ROUTING

match access-group name OSPF

match access-group name EIGRP

Do you see a problem with this? A stated earlier the incoming packing will NOT have both EIGRP and OSPF in the same packet. So if we try a

match-all

that means we are saying we need to match the packet on the OSPF AND the EIGRP ACL. Since this is not possible it wont match and the policy is useless. Now lets try the

match -any

class-map match-any ROUTING

match access-group name OSPF

match access-group name EIGRP

This says that the packet an

match ANY

of the routing protocols identified. Either OR. So this is a scenario where you want to use the ANY when the packet will have 1 or some of the criteria listed in the

class map

and use ALL when it needs to match all of the criteria specified.

Edited to show that you dont need an ACL and you can match on protocols specifically in the

class-map

R1(config)#class-map EIGRP
R1(config-cmap)#match protocol eigrp 

No ACL needed and as you can see a plethora of other protocols can match on.

Hope that clears it up a bit more and feel free to ask more questions if needed.

-David

[Joseph W. Doherty]

class-map match-all TEST

match ip dscp CS3

match ip dscp AF31

match ip dscp AF32

match ip dscp AF33

The

MATCH-ALL

says the packet must contain ALL of the DSCP values in order for the policy to hit."

BTW, although David didn't explicitly mention it, the above cannot match anything (because there's only one DSCP marking per packet).

[David Ruess]

Good catch. As you can see I had a lot going on in that post lol. Another good reason

match-all

is useless for multiple DSCP values.

[Joseph W. Doherty]

David's reply is a good explanation and example of the ALL or "and" situation.

An example of the ANY or "or" situation.

class-map match-any TEST
 match ip dscp CS3
 match ip dscp AF31
 match ip dscp AF32
 match ip dscp AF33

!but the forgoing could also be written as:

class-map match-all TEST
 match ip dscp CS3 AF31 AF32 AF33

[nwekechampion]

Thanks so much guys!

A lot clearer now

Essentially when doing DSCP marking , best to just use

match-any

as it can only match one marking per packet anyway.

[Joseph W. Doherty]

---

@nwekechampion wrote:

Essentially when doing DSCP marking , best to just use

match-any

as it can only match one marking per packet anyway.

---

Not necessarily, as you might use it with something else, e.g.:

class-map match-all example
 match ip dscp BE CS1
 match protocol ftp

[nwekechampion]

Thanks. Yep for matching multiple criteria.. i.e: something other than dscp