Re: Cat 2960 - policy-map / service-policy input is not working

Sven Hruza · ‎11-10-2011

Hello,

I have some trouble with that policy-map on my 2960 or 3560 switches with LAN base 12.2(53)SE2.

I want to use that feature to catch video traffic from webcams in laptops which can't send dscp values out of the box.

This is my test config to check if the function is working:

!

! catch every traffic from my workstation for testing

!

access-list 101 permit ip any any

!

class-map match-all CL_TEST

match access-group 101

!

! set dscp to 41 for all traffic

!

policy-map PM_TEST

class CISCO

set ip dscp af41

!

interface fastethernet 0/1

service-policy input PM_TEST

!

I see two problems:

1. I can't see any counters with the command "sh policy-map interface FastEthernet 0/1". Cisco tells that this command is not possible.

But how I can see if the policy is woring correct?

2. When I did the configuration I can't see any pakets with dscp af41 on the out going interface on the switch with "sh mls qos int gi0/1 statistic" as I expected. After reloading the switch I see the pakets with af41. Okay for that moment.

But.....

After that I changed something in the policy-map. Only "set ip dscp ef" for a second test.

Generating some traffic I see only pakets with af41 as before I changed the policy-map. No traffic with ef on the outgoing interface.

My asumption is that I can configure that feature, but the switch is not able to write the config down to its TCAM or something like that.

Only with a reboot the policy-map will be written correct down to the hardware and will work as it should.

Do anybody know something about that?

Thanks a lot for every advice.

Sven

Sven Hruza · ‎11-12-2011

I did some more research on this issue and think now that the problem is an IOS bug in some versions.

I tried the version 12.2(55)SE1 and it works. I can change the policy-map and it takes effect in the same moment on the input interface.

After that I did tests with the following versions:

12.2(50)SE3 - hits the issue

12.2(52)SE - hits the issue

12.2(55)SE1 - works fine

12.2(58)SE2 - works fine

15.0(1)SE - works fine

So I tink there was a fix between 52 and 55 but I can't find a bug ID for that.

As a workaround to get the changed policy-map working on the input interfaces it helps to delete the "service-policy input from the interfaces and configure it again after changing the policy-map.

I will inform my case owner in TAC about that and will post the bug ID if there is one.

Sven

ma4d · ‎11-25-2011

Thanks for your post. I'd just like to add this line concerning "show policy-map" that I found in the command reference after running into the same issue:

Note

Though visible in the command-line help string, the

control-plane

and

interface

keywords are not supported, and the statistics shown in the display should be ignored.

rcongani · ‎11-26-2011

Hello sven

The sh policy map command is not supported for this platform due to hardware limitaion. Following is the documented bug.

CSCso80701

"show policy-map interface" in 2960, 2970, 3560, 3750 should give error

Release notes
http://wwwin-tools.cisco.com/dir/details/johgill

Symptom:
"show policy-map interface"  shows no matches

Conditions:
This command is run on one of the following switches:
2950
2960
2970
3550
3560
3750

Workaround:
This is a hardware limitation and these switches do not support this output.  There is no workaround.

---------------------------------------------------------------------------------------------

But you can use the following commnad to see statistics and its really helpful and if the policer dropping traffic, it will show under out of profiler.

-2960-2#sh mls qos interface gigabitEthernet 1/0/1 statistics

GigabitEthernet1/0/1 (All statistics are in packets)

dscp: incoming

-------------------------------

0 - 4 : 0 0 0 0 0

5 - 9 : 0 0 0 0 0

10 - 14 : 0 0 0 0 0

15 - 19 : 0 0 0 0 0

20 - 24 : 0 0 0 0 0

25 - 29 : 0 0 0 0 0

30 - 34 : 0 0 0 0 0

35 - 39 : 0 0 0 0 0

40 - 44 : 0 0 0 0 0

45 - 49 : 0 0 0 0 0

50 - 54 : 0 0 0 0 0

55 - 59 : 0 0 0 0 0

60 - 64 : 0 0 0 0

dscp: outgoing

-------------------------------

0 - 4 : 0 0 0 0 0

5 - 9 : 0 0 0 0 0

10 - 14 : 0 0 0 0 0

15 - 19 : 0 0 0 0 0

20 - 24 : 0 0 0 0 0

25 - 29 : 0 0 0 0 0

30 - 34 : 0 0 0 0 0

35 - 39 : 0 0 0 0 0

40 - 44 : 0 0 0 0 0

45 - 49 : 0 0 0 0 0

50 - 54 : 0 0 0 0 0

55 - 59 : 0 0 0 0 0

60 - 64 : 0 0 0 0

cos: incoming

-------------------------------

0 - 4 : 0 0 0 0 0

5 - 7 : 0 0 0

cos: outgoing

-------------------------------

0 - 4 : 0 0 0 0 0

5 - 7 : 0 0 0

output queues enqueued:

queue: threshold1 threshold2 threshold3

-----------------------------------------------

queue 0: 0 0 0

queue 1: 0 0 0

queue 2: 0 0 0

queue 3: 0 0 0

output queues dropped:

queue: threshold1 threshold2 threshold3

-----------------------------------------------

queue 0: 0 0 0

queue 1: 0 0 0

queue 2: 0 0 0

queue 3: 0 0 0

Policer: Inprofile: 0 OutofProfile: 0

Sven Hruza · ‎02-20-2012

Hey,

I want to update this thread because I got feedback from cisco.

It is not recommended by cisco to use a policy-map together with the command "mls qos trust cos" on the same interface. It is working on some IOS, but not on all. That is not a bug!

To get both features running we had to build the function of "mls qos trust cos" inside the policy-map and then use only this for trusting or marking the dscp or cos values.

After deleting the "mls qos trust cos" the policy-map is working directly after I change a value inside.

Thanks for the help!

Sven