Testing Egress Marking in NX-OS QoS

Updated: 09/18/2012
I had been unsuccessful in my attempts to implement egress marking on a Nexus 7000 running NX-OS 5.2(4). Outbound policy-maps for marking are supposed to be supported in NX-OS 5.x, as stated in the Cisco documentation here http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/qos/configuration/guide/marking.html#wp1062618 :

You can apply the marking instructions in a QoS policy map to ingress or egress packets by attaching that QoS policy map to an interface. To select ingress or egress, you specify either the input or output keyword in the service-policy command.

I’ll show you my lab results – perhaps you can spot the issue.  (In Testing Egress Marking in NX-OS QoS – Part 2, I’ll discuss why initially outbound marking did not work, and what else was needed.)

Basic Topology

I connected a pair of N7Ks with a trunked link and a Layer 3 link, and configured one VLAN and SVI to simulate one class of traffic. The lab topology looks like this:

The Layer 3 link between the N7Ks will be used to test egress marking.

Note: You cannot apply outbound policy maps to Layer 2 interfaces.

N7K-1 has a default route to 10.12.22.2 on N7K-2, 65K has as default route to 10.22.22.2 on N7K-2.

Classification ACLs

I reused a simplified ACL structure from Deny Equals Permit in NX-OS QoS ACLs:

! QoS Trust Boundary Access-Lists
!
ip access-list QOS-VOICE
 permit ip any 10.120.11.0 0.0.0.255
 permit ip 10.120.11.0 0.0.0.255 any
!

QoS Class-Maps for Classification

I made some basic class-maps and the corresponding policy-maps, one set to mark traffic on the 7Ks, one set to verify the markings on N7K-2.

! identify the voice traffic to be marked
class-map type qos match-any IN-VOICE
 description Voice/VoIP/IPT
 match access-group name QOS-VOICE
!

! identify marked traffic
class-map type qos match-all DSCP46
 match dscp 46
class-map type qos match-all DSCP1
 match dscp 1
!

QoS Policy-Maps for Classification

Here are the policy-maps that will be used to mark incoming traffic according to the previous classification ACLs and class-maps, and to verify the markings of the traffic received.

! used to mark in-bound traffic from 65K on N7K-2
policy-map IN-MARKING
  description Inbound classification/marking policy for trust boundaries.
  class IN-VOICE
    set dscp ef
!

!
! used to remark traffic on N7K-1
policy-map type qos CHANGE-DSCP
 class DSCP46
   set dscp 1
!

!
! used to verify traffic markings on N7K-2
policy-map type qos IN-DSCP
 class DSCP46
   set dscp 46
 class DSCP1
   set dscp 1
!

Applying the Policy-Maps on N7K-2

I applied the IN-MARKING and the IN-DSCP policy-maps on N7K-2.

!
interface eth 1/15
 service-policy input IN-MARKING
!
interface eth 2/10
 service-policy input IN-DSCP
!

Verifying the Basic Marking

Next, a quick ping test from 65K to VLAN 11 on N7K-1.

65K#ping 10.120.11.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.120.11.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
65K#

. . .

N7K-2(config-if)# sh pol int e2/10


Global statistics status : enabled

Ethernet2/10

 Service-policy (qos) input: IN-DSCP
 SNMP Policy Index: 285213031

 Class-map (qos): DSCP46 (match-all)

 Slot 2
 5 packets 590 bytes
 5 minute offered rate 0 bps

 Aggregate forwarded :
 5 packets 590 bytes
 Match: dscp 46
 set dscp 46

 Class-map (qos): DSCP1 (match-all)

 Aggregate forwarded :
 0 packets
 Match: dscp 1
 set dscp 1

. . .
! looks fine

Testing Ingress Re-Marking on N7K-1
Next, apply ingress re-marking policy on N7K-1 and confirm it works as expected.
 

!
N7K-1(config)# int e2/9
N7K-1(config-if)# ser in CHANGE-DSCP
N7K-1(config-if)#

. . .

65K#ping 10.120.11.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.120.11.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
65K#

. . .

N7K-2# sh pol int e1/10


Global statistics status : enabled

Ethernet1/10

 Service-policy (qos) input: IN-DSCP

 Class-map (qos): DSCP46 (match-all)

 Slot 2
  5 packets 590  bytes
  5 minute offered rate 0 bps

 Aggregate forwarded :
 5 packets 590 bytes
 Match: dscp 46
 set dscp 46

 Class-map (qos): DSCP1 (match-all)

 Slot 2
 5 packets 590 bytes
 5 minute offered rate 0 bps

 Aggregate forwarded :
 5 packets 590 bytes
 Match: dscp 1
 set dscp 1

That worked as expected – the ping traffic was marked on N7K-2 and re-marked on N7K1.
Testing Egress Re-Marking on N7K-1

!
N7K-1(config)# int e2/9
N7K-1(config-if)# no ser in CHANGE-DSCP
N7K-1(config-if)#
N7K-1(config-if)# int e2/10
N7K-1(config-if)# ser out CHANGE-DSCP
N7K-1(config-if)#

. . .

65K#ping 10.120.11.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.120.11.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
65K#

. . .

N7K-2# sh pol int e1/10


Global statistics status : enabled

Ethernet1/10

 Service-policy (qos) input: IN-DSCP

 Class-map (qos): DSCP46 (match-all)

 Slot 2
 10 packets 1180 bytes
   5 minute offered rate 0 bps

 Aggregate forwarded :
 10 packets 1180 bytes
 Match: dscp 46
 set dscp 46

 Class-map (qos): DSCP1 (match-all)

 Slot 2
 5 packets 590  bytes
 5 minute offered rate 0 bps

 Aggregate forwarded :
 5 packets 590 bytes
 Match: dscp 1
 set dscp 1

The egress policy did NOT work – although the ping traffic was marked on N7K-2, it was NOT re-marked on N7K-1.

Summary

Based on the documentation, egress policy maps for marking should work for NX-OS on Nexus 7000s. After going back for some more tests in the lab, I determined that there was an issue with the lab environment – the details will be discussed in the next article Testing Egress Marking in NX-OS QoS – Part 2.

— cwr

_____________________________________________________________________________________________

If you would like some additional on NX-OS QoS, you may want to review the following articles: 

• Deny Equals Permit in NX-OS QoS ACLs
• QoS on the Nexus 5000/2000 – Part 1
• (Configuring) QoS on the Nexus 5000/2000 – Part 2
• Trust Boundaries and QoS on the Nexus 5000/2000 – Part 3