QoS - Class-Map doesn't match the statement

[Federico Olivieri]

Hi,

I have create this class-map 

887VA#show class-map
Class Map match-any DSN_SERVER (id 5)
Match access-group name DNS

That match this ACL

887VA#show access-lists DNS
Extended IP access list DNS
10 permit udp any eq domain any
20 permit udp any any eq domain
30 permit tcp any eq domain any
40 permit tcp any any eq domain

But when I apply it seems that doesn't match any packets 

Class-map: DSN_SERVER (match-all)
0 packets, 0 bytes
30 second offered rate 0000 bps, drop rate 0000 bps
Match: access-group name DNS
Priority: 30% (16 kbps), burst bytes 1500, b/w exceed drops: 0

If I use the preconfigured cisco dns value for class map, seems working fine

Class Map match-all DNS (id 4)
Match protocol dns

Class-map: DNS (match-all)
166 packets, 16615 bytes
30 second offered rate 0000 bps, drop rate 0000 bps
Match: protocol dns
Priority: 30% (16 kbps), burst bytes 1500, b/w exceed drops: 0

• Anyone can spot any errors in my first part of configuration?
• The Match protocol dns match source or destination port 53?
  
  Thanks

[Philip D'Ath]

It looks correct to me.

I did notice your first class-map was a "match-any" and the second was a "match-all" but this should not make any difference if there is only one match criteria.

[Federico Olivieri]

Hi,
Thanks for your reply. Do you know if the Match protocol dns match source or destination port 53?

Thanks

Federico

[Philip D'Ath]

I'm 80% confident it matches both.

[Richard Bradfield]

the only thing I see is

Class-map: DSN_SERVER (match-all) <whereas should be match-any it is on my routers!

so are you sure you have

Class Map match-any DSN_SERVER 

in the configuration

[Federico Olivieri]

Found by myself. I did apply to interface instead to SVI.

A question for you guys:

The Match protocol dns match source or destination port 53?

Thanks

[Richard Bradfield]

Usually match both, but depends on your DNS setup,whether your DNS server has to go to a higher authority within  the DNS domain, or just receives requests from clients.

With your ACLs I would not have " any any" I would use the  addresses of the DNS servers

[Federico Olivieri]

Thanks Richard. 
My server is recursive, that means will use source and destination