QoS Policy-map being rejected on Core Switch interfaces

[dannyh]

Hello,

I'm trying to apply Voice, Video, and some critical data QoS to out network. I've done the research on how to create a class-map, policy-map, and how to apply the policy-map to the interface. However, when I try to apply the policy-map, it is getting rejected with error message:

"Invalid queuing class-map!!! Queuing actions supported only with dscp/cos/qos-group/precedence/exp based classification!!!"

I've tried using both dscp and cos just as the message is saying, but the policy-map won't get applied to the interface.

class-map match-any VIDEO

match protocol rtp video

match cos 5

class-map match-any VOICE

match protocol rtp audio

match ip dscp default

policy-map QOS-POLICY

class VOICE

priority level 1 percent 25

class VIDEO

priority level 2 percent 25

This is the class-map and policy map that is currently configured. Our switch is Cisco Catalyst 9500-40x. Is there switches that can't accept certain QoS configurations? I've read that the interface supports certain QoS traffic and this is the result of the interface i'm trying too apply this to:

TenGigabitEthernet1/0/38

Model: C9500-40X

Type: SFP-10GBase-LR

Speed: 10000

Duplex: full

Trunk encap. type: 802.1Q

Trunk mode: on,off,desirable,nonegotiate

Channel: yes

Broadcast suppression: percentage(0-100)

Unicast suppression: percentage(0-100)

Multicast suppression: percentage(0-100)

Flowcontrol: rx-(off,on,desired),tx-(none)

Fast Start: yes

QoS scheduling: rx-(not configurable on per port basis),

tx-(2p6q3t)

CoS rewrite: yes

ToS rewrite: yes

UDLD: yes

Inline power: no

SPAN: source/destination

PortSecure: yes

Dot1x: yes

Breakout Support: not applicable

Is the interface compatible for the QoS?

[Joseph W. Doherty]

Unsure a 9500 supports NBAR matching.

[dannyh]

I am reading that it does support it. But could it be based on the type of 9500-40x we have? This is what is shown from our 'show version.'

Cisco IOS XE Software, Version 17.06.03
Cisco IOS Software [Bengaluru], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 17.6.3, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2022 by Cisco Systems, Inc.
Compiled Wed 30-Mar-22 23:09 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2022 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON
BOOTLDR: System Bootstrap, Version 17.6.1r[FC2], RELEASE SOFTWARE (P)

MIL-B20-CoreSW1 uptime is 2 weeks, 2 days, 21 hours, 9 minutes
Uptime for this control processor is 2 weeks, 2 days, 21 hours, 10 minutes
System returned to ROM by PowerOn at 09:58:36 PDT Sat Apr 8 2023
System restarted at 13:16:15 PDT Sat May 13 2023
System image file is "flash:packages.conf"
Last reload reason: PowerOn

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Technology Package License Information:

------------------------------------------------------------------------------
Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------------------
network-advantage Smart License network-advantage
dna-advantage Subscription Smart License dna-advantage
AIR License Level: AIR DNA Advantage
Next reload AIR license Level: AIR DNA Advantage

Smart Licensing Status: Registration Not Applicable/Not Applicable

cisco C9500-40X (X86) processor with 1317232K/6147K bytes of memory.
Processor board ID FOC2427L21Y
19 Virtual Ethernet interfaces
48 Ten Gigabit Ethernet interfaces
2 Forty Gigabit Ethernet interfaces
2048K bytes of non-volatile configuration memory.
16777216K bytes of physical memory.
1638400K bytes of Crash Files at crashinfo:.
11264000K bytes of Flash at flash:.

Base Ethernet MAC Address : 80:2d:bf:53:be:80
Motherboard Assembly Number : 73-18140-03
Motherboard Serial Number : FOC24260V1M
Model Revision Number : G0
Motherboard Revision Number : C0
Model Number : C9500-40X
System Serial Number : FOC2427L21Y
CLEI Code Number :

Switch Ports Model SW Version SW Image Mode
------ ----- ----- ---------- ---------- ----
* 1 50 C9500-40X 17.06.03 CAT9K_IOSXE INSTALL

[Joseph W. Doherty]

"I am reading that it does support it. But could it be based on the type of 9500-40x we have? This is what is shown from our 'show version.'"

BTW, reading 

• Release Notes for Cisco Catalyst 9500 Series Switches, Cisco IOS XE Bengaluru 17.6.x

Interesting NBAR mentions, don't know all that might apply, as haven't studied these release notes and/or compared to your model of 9500, but things like:

Unsupported Features: Cisco Catalyst 9500 Series Switches - High Performance

• Network-Based Application Recognition (NBAR) and Next-Generation NBAR (NBAR2)

I think the high-performance variant is the 9500X models (not your model, I believe).

Limitations and Restrictions

Wired Application Visibility and Control limitations:

• NBAR2 (QoS and Protocol-discovery) configuration is allowed only on wired physical ports. It is not supported on virtual interfaces, for example, VLAN, port channel nor other logical interfaces.

• NBAR2 based match criteria ‘match protocol’ is allowed only with marking or policing actions. NBAR2 match criteria will not be allowed in a policy that has queuing features configured.

• ‘Match Protocol’: up to 256 concurrent different protocols in all policies.

• NBAR2 and Legacy NetFlow cannot be configured together at the same time on the same interface. However, NBAR2 and wired AVC Flexible NetFlow can be configured together on the same interface.

• Only IPv4 unicast (TCP/UDP) is supported.

•  
• NBAR2 attachment should be done only on physical access ports. Uplink can be attached as long as it is a single uplink and is not part of a port channel.

I wonder about the entry I've highlighted in red, as it seems to correspond with with your error message and your policy is queuing while doing NBAR matching.  You might try your policy after removing the match protocol statements in the class maps and see if 9500 is "happy".  If it is, you might use an ingress policy to match protocol and set DSCP/CoS/QoS-Group and then match on that in the egress policy.  Effectively, same result, although possibly you might need to setup an ingress policy on many ingress ports.

[MHM Cisco World]

Use AutoQoS
https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9000/white-paper-c11-742388.html#AutoQoS

[dannyh]

Does this in some way apply to the currently class-map and policy-map that is in place? or it is a completely separate configuration? Does it only apply to the global configuration? I am only seeing 'auto qos global' command in global configuration.

[MHM Cisco World]

it complete separate.

[Joseph W. Doherty]

How is interface actually configured?

[dannyh]

The interfaces that are connecting to Core SW2 (for redundancy) and two Distribution Switches (1 and 2) are configured to be in trunk mode.

[Joseph W. Doherty]

Sorry, I guess I wasn't clear - could you post actual interface config?

[dannyh]

As in 'show run interface ten x/y/z?'

[Joseph W. Doherty]

Yes, but if you want to "sanitize" something like an IP address, or anything else you believe is confidential, that's fine.

Basically, you've posted class-maps and policy, want to "see" invocation config.

[dannyh]

"Basically, you've posted class-maps and policy, want to "see" invocation config."
I don't understand what you mean by this.

[Joseph W. Doherty]

Again, "yes" to your prior question to me.

[dannyh]

interface TenGigabitEthernet1/0/38
switchport mode trunk
end