Catalyst 2960X QoS does not marking ingress

[morabusa]

Hello All,

I am having issues with some devices because I am getting traffic congestion in the uplink interfaces. I have AutoQoS configured in the device but it doesn't work for jabber users and they are having issues when there are traffic spikes. I have decided to configure a different QoS policy to apply to these users but I have the feeling that this is not working properly. This is my QoS configuration:

!
mls qos map policed-dscp 0 10 18 24 46 to 8
mls qos map cos-dscp 0 8 16 24 32 46 48 56
mls qos srr-queue output cos-map queue 1 threshold 3 4 5
mls qos srr-queue output cos-map queue 2 threshold 1 2
mls qos srr-queue output cos-map queue 2 threshold 2 3
mls qos srr-queue output cos-map queue 2 threshold 3 6 7
mls qos srr-queue output cos-map queue 3 threshold 3 0
mls qos srr-queue output cos-map queue 4 threshold 3 1
mls qos srr-queue output dscp-map queue 1 threshold 3 32 33 40 41 42 43 44 45
mls qos srr-queue output dscp-map queue 1 threshold 3 46 47
mls qos srr-queue output dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23
mls qos srr-queue output dscp-map queue 2 threshold 1 26 27 28 29 30 31 34 35
mls qos srr-queue output dscp-map queue 2 threshold 1 36 37 38 39
mls qos srr-queue output dscp-map queue 2 threshold 2 24
mls qos srr-queue output dscp-map queue 2 threshold 3 48 49 50 51 52 53 54 55
mls qos srr-queue output dscp-map queue 2 threshold 3 56 57 58 59 60 61 62 63
mls qos srr-queue output dscp-map queue 3 threshold 3 0 1 2 3 4 5 6 7
mls qos srr-queue output dscp-map queue 4 threshold 1 8 9 11 13 15
mls qos srr-queue output dscp-map queue 4 threshold 2 10 12 14
mls qos queue-set output 1 threshold 1 100 100 50 200
mls qos queue-set output 1 threshold 2 125 125 100 400
mls qos queue-set output 1 threshold 3 100 100 100 400
mls qos queue-set output 1 threshold 4 60 150 50 200
mls qos queue-set output 1 buffers 15 25 40 20
mls qos
!

!
class-map match-all AUTOQOS_VOIP_DATA_CLASS
match ip dscp ef
class-map match-all AUTOQOS_DEFAULT_CLASS
match access-group name AUTOQOS-ACL-DEFAULT
class-map match-all AUTOQOS_VOIP_SIGNAL_CLASS
match ip dscp cs3
class-map match-any JabberSoftPhone
match access-group 100
!
policy-map JabberSoftPhone
class JabberSoftPhone
set dscp cs5
class AUTOQOS_DEFAULT_CLASS
set dscp default
policy-map AUTOQOS-SRND4-CISCOPHONE-POLICY
class AUTOQOS_VOIP_DATA_CLASS
set dscp ef
police 128000 8000 exceed-action policed-dscp-transmit
class AUTOQOS_VOIP_SIGNAL_CLASS
set dscp cs3
police 32000 8000 exceed-action policed-dscp-transmit
class AUTOQOS_DEFAULT_CLASS
set dscp default
police 10000000 8000 exceed-action policed-dscp-transmit
!

!
interface GigabitEthernet1/0/39         <--- Here we have a regular Phone connected which works properly and has not issues.
switchport access vlan 14
switchport voice vlan 100
srr-queue bandwidth share 1 30 35 5
priority-queue out
mls qos trust device cisco-phone
mls qos trust cos
auto qos voip cisco-phone
spanning-tree portfast
service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY
!
interface GigabitEthernet1/0/40      <--- Here we have a PC with Jabber connected
switchport access vlan 14
switchport voice vlan 100
spanning-tree portfast
service-policy input JabberSoftPhone
!

access-list 100 permit udp any any range 16384 32766
access-list 100 permit udp any any range 33434 33598
access-list 100 permit udp any any range 49152 65535
access-list 100 permit ip host 10.34.6.129 any        <--- This is the IP of the device connected to the interface Gi1/0/40

The problem I am having is that I am no getting any CS5 incoming packet marked in the interfaces where I have Jabber PCs connected, even when I have specified to mark as CS5 all the traffic for the PC connected in the interface Gi1/0/40.    

10.34.6.154#show mls qos interface GigabitEthernet1/0/40 statistics
GigabitEthernet1/0/40 (All statistics are in packets)

dscp: incoming
-------------------------------

0 - 4 : 170652732 0 0 0 0
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 0 0 0 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0
dscp: outgoing
-------------------------------

0 - 4 : 45002777 0 0 0 0
5 - 9 : 0 0 0 92223235 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 17323759
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 21607 0 0 0 0
45 - 49 : 0 6668491 0 134162 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 28419382 0 0 0
60 - 64 : 0 0 0 0
cos: incoming
-------------------------------

0 - 4 : 295199164 0 0 0 0
5 - 7 : 0 0 0
cos: outgoing
-------------------------------

0 - 4 : 1020220305 92223235 0 17324356 0
5 - 7 : 6690366 134162 89207561
output queues enqueued:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 0 0 6690305
queue 1: 40421632 623814078 92509930
queue 2: 0 0 954091876
queue 3: 54313 0 92168922

output queues dropped:
queue: threshold1 threshold2 threshold3
-----------------------------------------------
queue 0: 0 0 0
queue 1: 0 0 0
queue 2: 0 0 7799
queue 3: 1375 0 44484

Policer: Inprofile: 0 OutofProfile: 0

Can you please help me to find the issue or tell me if I am missing something in the configuration?. Thank you very much.

Best Regards.

[paul driver]

Hello

The cos-dscp, dscp-cos output mapping look okay as they both set the value cos 5 , dscp 40-45 to egress Q1 but I don't see any priority queue defined on gig1/0/40

As for the marking I guess you could just apply the following on that access port

int gig1/0/40
mls qos cos 5
mls qos cos override

[morabusa]

Hello Paul,

Thank you for the answer. I am going to try these changes but, will your suggested configuration mark all the incoming traffic as cos5? If it is the case, it won't work for me. Take in mind that we have a PC using Jabber connected in the Gig1/0/40 port, and I just want to mark the VoIP traffic (specified in the ACL100). Plus take in mind that I am just having issues with the incoming/uploading traffic in the interface Gig1/0/40.

Best Regards.

[paul driver]

Hello

---

@morabusa wrote:

Hello Paul,

Thank you for the answer. I am going to try these changes but, will your suggested configuration mark all the incoming traffic as cos5? I

---

Yes it will , so it wont be viable now you have explained - have you  appended the priority queue to that interface?

[morabusa]

Do you mean the command: priority-queue out? No, I have this command just configured in the uplink ports, but not in the access port connected to the PCs. 

Access port configuration:

interface GigabitEthernet1/0/40
switchport access vlan 14
switchport voice vlan 100
spanning-tree portfast
service-policy input JabberSoftPhone
end

Uplink port configuration in the switch:

interface GigabitEthernet3/0/49
switchport mode trunk
srr-queue bandwidth share 1 30 35 5
priority-queue out
mls qos trust cos
macro description cisco-switch
auto qos trust
spanning-tree link-type point-to-point
channel-group 1 mode on
ip dhcp snooping trust
end

Thanks.

Best Regards.

[morabusa]

BTW, I have tested the suggested commands and I still don't get incoming packets marked as cos5.

Thanks.

Best Regards. 

[Joseph W. Doherty]

I don't recall if it's required with an ingress service policy, but I'm wondering whether a trust DSCP is required on the interface too.