2960X Service-policy not applied

[Amit M.]

Hi experts,

I have a 2960X switch with LAN Base license (NOT Lite).

Ive created a Policy-map and Im trying to apply an input QoS marking policy to an interface ("service-policy input XXXXX) but everytime I "show run" the interface, the service-policy isnt applied (it doesn´t appear) and also I dont see nothing if I do a "show policy-map interface".

Is this a bug or something?

The switch is in a stack. I´ve read all the "not do do´s" (like 2960X doesn´t support VLAN based QoS, just physical interfaces) and the version is:

Cisco IOS Software, C2960X Software (C2960X-UNIVERSALK9-M), Version 15.0(2)EX5, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Fri 21-Feb-14 05:54 by prod_rel_team

ROM: Bootstrap program is C2960X boot loader
BOOTLDR: C2960X Boot Loader (C2960X-HBOOT-M) Version 15.2(2r)E1, RELEASE SOFTWARE (fc1)

swccevg01 uptime is 32 weeks, 5 days, 17 hours, 40 minutes
System returned to ROM by power-on
System restarted at 02:00:21 CET Thu Dec 19 2019
System image file is "flash:/c2960x-universalk9-mz.150-2.EX5/c2960x-universalk9-mz.150-2.EX5.bin"

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco WS-C2960X-48TS-L (APM86XXX) processor (revision H0) with 524288K bytes of memory.
Last reset from power-on
2 Virtual Ethernet interfaces
1 FastEthernet interface
312 Gigabit Ethernet interfaces
The password-recovery mechanism is enabled

Can someone help me?

The policy-map and class-map is as follows (very simple):

policy-map MARKING_POLICING
class REAL_TIME
set ip dscp ef
class CRITICAL_DATA
set ip dscp af31
class BUSINESS_DATA
set ip dscp af21
class class-default
set ip dscp af11
!
class-map match-any CRITICAL_DATA
match access-group name CRITICAL_DATA_ACL
class-map match-any BUSINESS_DATA
match access-group name BUSINESS_DATA_ACL
class-map match-any REAL_TIME
match access-group name REAL_TIME_ACL
match access-group name GES_SSH_ACL
match ip dscp ef

Best regards

Amit

[marce1000]

 - Probably a bug , check with recent or advised release for this platform.

 M.

[Rich R]

That IOS is very old and almost end of support https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-2960-x-series-switches/eos-eol-notice-c51-736509.html so I'd start by getting a current, supported IOS on the box - for example recommended release https://software.cisco.com/download/home/284795739/type/280805680/release/15.2.7E2
Then if it doesn't work you can at least open a TAC case about it.

[Amit M.]

Hi guys

Thanks for your help!

I founded out the issue. The 2960X platform doesnt support various OR matches, this class-map was the issue:

class-map match-any REAL_TIME
match access-group name REAL_TIME_ACL
match access-group name GES_SSH_ACL
match ip dscp ef

The platform doesn´t let me match (ORs) various access-groups + (OR) an ef marking. I had to split this into various class-maps and make bigger my policy-map. 

So yes, it looks that this is a Bug or even a software update is needed...

Best regards