Egress class match to an ACL in an NCS540 v7.3.1

[umomait]

Hello,
I have an NCS540 v7.3.1 and I am trying to replicate the same rate limiting policies we have setup on the ASR9000 devices. I am unable to use the Rate_Limit class in my policy map as it shows the error below. Is there a way to get around that error? setting match type as class_default works with no issues.

!!% 'DPA_QOSEA' detected the 'warning' condition 'Unsupported match type for egress'

Configuration:

ipv4 access-list 101
10 permit ipv4 any any

class-map match-all Rate_Limit
match access-group ipv4 101
end-class-map

policy-map 100mbps_egress
class Rate_Limit
shape average 150 mbps
!
end-policy-map
!

[smilstea · Accepted solution]

Access-group is only suppored on ingress as per the table under traffic class elements here: https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5xx/qos/75x/b-qos-cg-75x-ncs540/m-config-mod-qos-service-pkt-classification-ncs5xx.html#reference_25E90CC22EAC4882BC15F455E3952294

Thanks,
Sam

[Ramblin Tech]

As @smilstea suggests, you can use your access-group in an ingress class-map. The ingress policy for the class-map would set a qos-group. An egress class-map would match on the qos-group, with the egress policy for that class-map taking the shaping action.

IIRC, the DNX NPU in NCS55xx/5xx cannot match directly on an ACL in egress QoS policies.