QoS policing & marking input policy-map on interface

[paulkilcoyne]

Dear Cisco experts,

I'm rolling out QoS on a WAN network. On the LAN facing interface of a 3845 router I need to police and mark traffic from the LAN. I tried adding two separate service policies to the interface but this was rejected.

So my questions are;

1. Is it possible to have two inbound policies on an interface? If so how?

2. If the above is not possible how can the above be achieved using nested policies?

Below are my policies:

policy-map MARKING
 class VOICE
  set ip dscp ef
class REALTIME-INTERACTIVE
  set ip dscp af41
 class CRITICAL-DATA-AF31
  set ip dscp af31
 class CRITICAL-DATA-AF21
  set ip dscp af21
 class SIGNALING
  set ip dscp cs3
 class BULK-DATA
  set ip dscp af13
 class SCAVENGER
  set ip dscp cs1
 class NETWORK-CONTROL
  set ip dscp cs6
 class class-default

!

policy-map POLICING
 class VOICE
   police cir 5000000
     conform-action set-dscp-transmit ef
     exceed-action set-dscp-transmit ef
     violate-action set-dscp-transmit default

This is the error I get when attempting to add the second policy-map to the one interface:

router(config)#int gi 0/0/0
router(config-if)#service-policy input POLICING
 Policy map MARKING is already attached

Thanking you in advance for your help and time.

Regards,

Paul

[Joseph W. Doherty · Accepted solution]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages wha2tsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Only one ingress and/or egress service policy allowed.

You don't need a nested policy.  Change your MARKING policy's VOICE class to be what you have for your POLICING policy's VOICE class.

i.e.

policy-map MARKING
 class VOICE
  set ip dscp ef

   police cir 5000000
     conform-action set-dscp-transmit ef
     exceed-action set-dscp-transmit ef
     violate-action set-dscp-transmit default
class REALTIME-INTERACTIVE
  set ip dscp af41
 class CRITICAL-DATA-AF31
  set ip dscp af31
 class CRITICAL-DATA-AF21
  set ip dscp af21
 class SIGNALING
  set ip dscp cs3
 class BULK-DATA
  set ip dscp af13
 class SCAVENGER
  set ip dscp cs1
 class NETWORK-CONTROL
  set ip dscp cs6
 class class-default

!you also might want to set a marking for class-default

!perhaps BE

[paulkilcoyne]

Hi Joseph,

great answer, I will implement as suggested and also set marking of BE for class-default.

Many thanks,

Paul