cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
436
Views
0
Helpful
4
Replies

ASR QoS Class based policy not working as expected

manugarg19
Beginner
Beginner

Hi All,

 

I configured an ASR with following QoS

 

Ip access-list ext AF4

permit ip 10.0.0.0 255.255.255.0 any

 

ip access-list extended 197

permit ip any host 20.0.0.2

 

class-map match-all AF4_include

match not access-group 197

 

class-map match-any AF4_output

match class-map AF4_include

match access-group name AF4

 

Policy-map child

class AF4_output

set dscp af41

class class-default

 

policy-map parent

class class-default

service-policy child

 

As per my understanding QoS should only match AF4 ACL entry and mark then with AF41

However All the packet including not in the ACL AF4 are classified and marked as AF41.

 

Any help to understand what has been done wrong ?

 

Thanks in advance for help !!

 

Rgds

MG

 

1 Accepted Solution

Accepted Solutions

Hello @manugarg19 ,

>> all packets not matching ACL 197 are a match for class-map -- will there be further lookup for ACL AF4 ?

I was referring to the child class-map called AF4_include that is then invoked in class-map AF4_output that uses match-any that is a logical OR between (not matching ACL 197 ) OR ( matching ACL named AF4)

 

The further lookup for ACL AF4 is meaningful only for packets matching ACL 197 in that case AF4 ACL can decide the packet is a match if it sourced by subnet 10.0.0.0/24 .

Only one match is enough.

 

The final part does not change

 

Hope to help

Giuseppe

 

with match any all criteria must match at the same time.

 

Coming to your last post:

 

class-map match-all AF4_include

match not access-group 197

match not access-group 198

 

becomes

class-map match-all AF4_include

match not access-group 197 198

 

because a OR operator is used for similar match so packets not matching ACL 197 or not matching ACL 198 are a match for this class-map.

 

 

View solution in original post

4 Replies 4

Giuseppe Larosa
Hall of Fame Master Hall of Fame Master
Hall of Fame Master

Hello @manugarg19 ,

all packets not matching ACL 197 are a match for class-map

 

ip access-list extended 197

permit ip any host 20.0.0.2

 

class-map match-all AF4_include

match not access-group 197

 

class-map match-any AF4_output

match class-map AF4_include

match access-group name AF4

 

so class-map AF4_output will mark with DSCP AF41 all packets not matching ACL 197 or packets matching named ACL AF4.

 

Hope to help

Giuseppe

 

 

@Giuseppe Larosa 

 

Thanks for your reply.

 

all packets not matching ACL 197 are a match for class-map -- will there be further lookup for ACL AF4 ? I am confused here, as to me seems like all packets are already matching class-map and thus dropping further lookup and reason I am seeing every outgoing packet marked with DSCP AF4.

 

Can you help me understand. How Class-map match-all will work with this configuration ?

 

ip access-list ext 198 

permit tcp host 10.16.15.2 eq bgp any

permit tcp host 10.16.15.2 any eq bgp <<<<<<<<<<<< this is  configured WAN IP.

 

ip access ext 197

permit ip host 20.0.0.2 any <<<<<<<<<<<<<<<<<<<< its a device loopback IP.

 

ip access extended AF4

10.0.0.0 255.255.255.0 any

 

class-map match-all AF4_include

match not access-group 197

match not access-group 198

 

class-map match-any AF4_output

match class-map AF4_include

match access-group name AF4

 

Rgds

Manu Garg

Hello @manugarg19 ,

>> all packets not matching ACL 197 are a match for class-map -- will there be further lookup for ACL AF4 ?

I was referring to the child class-map called AF4_include that is then invoked in class-map AF4_output that uses match-any that is a logical OR between (not matching ACL 197 ) OR ( matching ACL named AF4)

 

The further lookup for ACL AF4 is meaningful only for packets matching ACL 197 in that case AF4 ACL can decide the packet is a match if it sourced by subnet 10.0.0.0/24 .

Only one match is enough.

 

The final part does not change

 

Hope to help

Giuseppe

 

with match any all criteria must match at the same time.

 

Coming to your last post:

 

class-map match-all AF4_include

match not access-group 197

match not access-group 198

 

becomes

class-map match-all AF4_include

match not access-group 197 198

 

because a OR operator is used for similar match so packets not matching ACL 197 or not matching ACL 198 are a match for this class-map.

 

 

@Giuseppe Larosa  Thanks for describing it.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers