I know this has been asked to death, but I cannot get this to work.
The setup: Cisco 3750. Multiple LAN ports and one WAN port.
The request: mark all RDP traffic from the LAN as AF31.
the commands I used:
access-list 180 permit tcp any any eq 3389
class-map match-all RDP-TRAFFIC
match access-group 180
policy-map SETDSCP-EF
class RDP-TRAFFIC
set dscp af31
int *Wan
mls qos trust dscp
int *lan
service-policy input SETDSCP-EF
I thought it was working, using the command "show mls qos int * statistic" I could see traffic in the queues incrementing, then I wanted to check further and am now convinced its not working. (When I remove all my rewrite config I still get a bit of traffic in the queues so that is no longer a valid test)
I was not able to sniff the packets with an analyzer because its a remote site, so what I did instead was, put an access-list on the interface as follows (in both directions in and out):
access-list 123 permit ip any any dscp ef log
access-list 123 permit ip any any dscp af31 log
access-list 123 permit tcp any any eq 3389 log
access-list 123 permit ip any any
That clearly told me it wasn't working, I cleared the access-list counters, left it for a while and got this:
Extended IP access list 123
10 permit ip any any dscp ef log
20 permit ip any any dscp af31 log (374 matches)
25 permit tcp any any eq 3389 log (73487 matches)
30 permit ip any any (43612 matches)
Now the access list is sequential, so I should see zero hits against my 3389 rule and a ton against the af31 rule. Because anyting that is 3389, should also be marked as af31 and match the first statement. But I am seeing a lot of traffic that is 3381 that does not have af31 set.
I tried removing the service policy off the physical interface and onto the vlan instead but I see the same results!
