Here is the config:

class-map match-any SILVER-CLASS

match access-group name SILVER-TRAFFIC

policy-map cust2provider-QOS

class REAL-TIME-CLASS

set dscp cs5

class GOLD-CLASS

set dscp cs4

class SILVER-CLASS

set dscp cs2

class class-default

set dscp default

ip access-list extended SILVER-TRAFFIC

deny tcp any 10.252.40.0 0.0.0.255 eq www

deny tcp any 10.252.40.0 0.0.0.255 eq 443

permit tcp any 10.0.0.0 0.255.255.255 eq www

permit tcp any 10.0.0.0 0.255.255.255 eq 443

This is the proposed config. I want to mark http and https traffic for 10.252.40.0 subnet with default dscp 0.

The current config (last 2 acl lines ) mark all http & https with CS2.

Okay that makes more sense.

Yes it will work as you want. The 10.252.40.0 will not be matched in the SILVER-TRAFFIC class and will fall through to the class-default.

HTH

Jon

hi Jon,

I just found a reference to it in qos config guide for cat 2970 and now i am not little doubtful after reading this. According to this guide after matching the deny statement it will continue to check ACL and in my case it will find a permit and as I understand it the traffic will still be be marked with CS2.

http://www.ciscosystems.ch/en/US/docs/switches/lan/catalyst2970/software/release/12.2_20_se/configuration/guide/swqos.html#wp1044742

**Classification Based on QoS ACLs **

You can use IP standard, IP extended, or Layer 2 MAC ACLs to define a group of packets with the same characteristics (class). In the QoS context, the permit and deny actions in the access control entries (ACEs) have different meanings than with security ACLs:

•If a match with a permit action is encountered (first-match principle), the specified QoS-related action is taken.

•If a match with a deny action is encountered, the ACL being processed is skipped, and the next ACL is processed.

•If no match with a permit action is encountered and all the ACEs have been examined, no QoS processing occurs on the packet, and the switch offers best-effort service to the packet.

tx

fawad

Hi Fawad

Okay, i tested this in our lab and it works as i suggested. This was tested on a 2600 router, i can retest on a 3560 switch if needed.

From what you posted

"If a match with a deny action is encountered, the ACL being processed is skipped, and the next ACL is processed"

Note that it does not say the next ACE (Access control Entry) but the next ACL. So it is saying stop processing that ACL and move onto the next ACL which may well be contained under another class map entry.

So when it hits the deny it stops running through that ACL, does not mark the packet and moves on in the policy map. If you had a BRONZE class configured which did match the packet it would be marked accordingly. But after SILVER you only have class-default so your packet gets processed in there.

HTH

Jon

hi Jon,

This makes perfect sense. Thanks much for your help!!!