QoS - Invalid queuing class-map

[jnewton83985]

I am getting the following error on a WS-C3850-48P running 16.6.9 after entering service-policy ouput PM-QOS on the uplink. I'm not trusting any end point markings so the trust boundary begins at the uplink.

Invalid queuing class-map!!! Queuing actions supported only with dscp/cos/qos-group/precedence/exp based classification!!!

Below is my config: 

class-map match-any CM-MCRITICAL
  match access-group name MCRITICAL

  match access-group name MCRITICAL_IPV6

class-map match-any CM-I-VIDEO

   match access-group name I-VIDEO

class-map match-any CM-VOICE

   match access-group name VOICE

class-map match-any CM-BULK_DATA

   match access-group name BULK_DATA

class-map match-any CM-TRAN_DATA

   match access-group name TRAN_DATA

Policy Map PM-QOS
Class CM-MCRITICAL
bandwidth 25 (%)
set dscp af31
Class CM-I-VIDEO
priority level 2 23 (%)
set dscp af41
Class CM-VOICE
priority level 1 10 (%)
set dscp ef
Class CM-BULK_DATA
bandwidth 5 (%)
set dscp af11
Class CM-TRAN_DATA
bandwidth 5 (%)
set dscp af21
Class class-default
bandwidth 32 (%)
set dscp default

[jnewton83985]

I was going to apply the ingress and egress service policies to the uplinks. My thought process is I am not trusting any markings so I was going to mark traffic on the uplink. Would you recommend that?

I first tried applying the service policy to the port channel interface however it gave me an error so I have to apply it per etherchannel member via int range cmd. 

Thanks for all your help Joseph. 

[Joseph W. Doherty]

Usually, traffic coming into a device, on its uplink/downlink is trusted, assuming verification of ToS was done on the edge.

[gmunozsuro]

You have to tag the inbound traffic to the switch with DSCP. you can use ACL. and put this policy in the inbound interface.

For the outbound traffic, you have to match those DSCP creating class-map and using "match dcsp X" . Later with a policy, you call this class maps and assign the BW and put this policy in the outbound interface

class-map match-any Class_test1
match access-group name acl_test1

policy-map Policy_test1
class Class_test1
set ip dscp 5

/inbound interface:
interface Gig1/0/3
service-policy input Policy_test1

class-map match-any Class_test1_dscp
match dscp 4

policy-map Policy_test1_dscp
class Class_test1_dscp
bandwidth 60000


/outbound interface:
interface Gig1/0/4
service-policy output Policy_test1_dscp