QoS - Need help Please!

[pmajumder]

Hi,

I have the following QoS config on my external router.

ip access-list extended Voice-Devices

remark Voicemail Servers

permit ip host X.X.X.47 any

permit ip any host X.X.X.47

class-map match-any COS1-EF

match access-group name Voice-Devices

class-map match-any VOICE

match ip dscp ef

match ip dscp af31

match access-group name Voice-Devices

policy-map Mark-COS1

class COS1-EF

set ip dscp ef

policy-map EIC-QoS-WAN

class VOICE

priority percent 12

service-policy Mark-COS1

class class-default

fair-queue

random-detect dscp-based

shape average 10000000

int s1/0

service-policy output EIC-QoS-WAN

My problem is that the traffic from x.x.x.47 is not been marked. However, traffic coming in with the ef and af31 bit already set is being picked up.

Can anyone give me a hand with this?

Thank you,

Pradeep

[John Blakley · Accepted solution]

Pradeep,

"My problem is that the traffic from x.x.x.47 is not been marked."

Are you needing this traffic marked? If the devices aren't marking the packet, you may need to mark the packet manually on the incoming interface that the device is connected to.

HTH,

John

[pmajumder]

Hi John,

Thanks for replying. Yes i do want that traffic marked with the DSCP value of "ef". Shouldn't x.x.x.47 satisfy the match criteria for class "COS1-EF" and mark that traffic accordingly?

Thanks,

Pradeep

[Peter Paluch]

Hello Pradeep,

This is interesting. Can you see the counters on the ACL actually increasing?

Best regards,

Peter

[pmajumder]

Hi Peter,

Yes I do see it increasing. In fact I am also sending icmp packets from x.x.x.47 as a test.

XD0R02#sh access-list Voice-Devices

Extended IP access list Voice-Devices

10 permit ip host X.X.X.47 any (52 matches)

20 permit ip any host x.x.x.47

Thanks,

Pradeep

[Peter Paluch]

Hello Pradeep,

I have pasted your config in my testing topology in Dynamips and it was working perfectly for me. The pings sent from X.X.X.47 were remarked with DSCP EF.

Are you absolutely sure that no remarking is taking place in your network? Is there perhaps a switch between the router and your machine where you capture the packets? Note that Catalyst switches with certain QoS settings may not trust DSCP marking and may reset it to 0.

Try using the command show policy-map interface s1/0 and watch closely for lines similar to these:

Class-map: COS1-EF (match-any)

1 packets, 104 bytes

5 minute offered rate 0 bps, drop rate 0 bps

Match: access-group name Voice-Devices

1 packets, 104 bytes

5 minute rate 0 bps

QoS Set

dscp ef

Packets marked 1

The last line should tell you if the marking is taking place. If yes and you still do not see the packets marked on your end device then there is probably some other device in your network remarking your packets.

Best regards,

Peter

[pmajumder]

Hi Peter,

I am doing the marking on the router itself, so even if the packet got marked somewhere between the x.x.x.47 device and the router, I am assuming the latter will remark it?

I did use the cmd sh policy-map int s1/0 but all counters showed zero incl Packets marked.

I hope it's not a bug in my IOS - IOS (tm) 3700 Software (C3745-IS-M), Version 12.3(22)

Let me wipe out the config and start again, just to make sure. I will post the result.

Thanks,

Pradeep

[Edison Ortiz]

class-map match-any VOICE

match ip dscp ef

match ip dscp af31

match access-group name Voice-Devices

___

Remove the access-group 'Voice-Devices' from the class-map - you already have it under class-map match-any COS1-EF .

When calling the policy under the interface, Class Voice gets called first and executes the ACL without the marking.

HTH,

__

Edison.

[chinkevi_2 · Accepted solution]

you're marking traffic after policing.

i would suggest to try create another inbound service policy on your lan interface for marking traffic instead.

[Peter Paluch]

Hello,

The fact alone that the marking takes place after policing should not be a problem (even if perhaps not the best practice in this particular case). After all, with two rate policer, the same is done. Moreover, as I indicated, I have tested the Pradeep's configuration exactly as posted her and it worked for me.

Best regards,

Peter

[pmajumder]

@Edison..Originally my config did not include the access-group 'Voice-Devices' in the VOICE class-map. I added it only when it did not work.

@Peter.. I tried removing and re-adding the config without any success. It seems that the nested service policy Mark-COS1 is never getting invoked.

@Chin & John.. Creating an inbound service policy on my LAN interface worked! Thank you!

Peter - I am puzzled since I thought my original config would work and it doesn't but clearly works in your case.

Even though my issue is resolved I would really like to understand why my original config did not work!!

Thanks,

Pradeep

[chinkevi_2]

i think it did not mark traffic because there was not enough bandwidth to make QoS kick in to police the traffic in the first place.

[Peter Paluch]

Hello,

I don't think this is the case. I have already seen it in other discussions here that it is assumed that the entire service policy kicks in only if the Tx ring of the interface starts to overfill.

In my opinion, that is not correct. A service policy on an interface must be evaluated for every packet. Only the software queueing kicks in when the Tx ring of the interface starts to fill but a service policy itself must act upon every packet.

This document provides slightly more detail:

http://www.cisco.com/en/US/tech/tk543/tk757/technologies_tech_note09186a0080160fc1.shtml

Best regards,

Peter

[ajaykumar2k1]

Pradeep

Not sure u missed or not.

Do the marking policy applied to correct interface.

Regards

Ajay