Classification is the separation of packets into traffic classes. You configure the device to take a specific action on the specified classified traffic, such as policing or marking down, or other actions.

You can create class maps to represent each traffic class by matching packet characteristics with the classification criteria in the following table:

You can specify multiple match criteria, you can choose to not match on a particular criterion, or you can determine the traffic class by matching any or all criteria.

Note	However, if you match on an ACL, no other match criteria, except the packet length, can be specified in a match-all class. In a match-any class, you can match on ACLs and any other match criteria.

Traffic that fails to match any class in a QoS policy map is assigned to a default class of traffic called class-default. The class-default can be referenced in a QoS policy map to select this unmatched traffic.

You can reuse class maps when defining the QoS policies for different interfaces that process the same types of traffic.

Classification has the following prerequisites:

• You must be familiar with using modular QoS CLI.

• You are logged on to the device.

Classification has the following configuration guidelines and limitations:

• QoS policy will not be effective for fragmented packets. Fragmented packets will be forwarded to the default queue.

• The show commands with the internal keyword are not supported.

• PVLANs do not provide support for PVLAN QoS.

• When the destination interface sup-eth0 CLI command is configured, the following system log message is displayed: Enabling span destination to SUP will affect ingress QoS classification.

• For VXLAN, the following Cisco Nexus platforms support QoS policies for traffic in the network to host direction (decapsulation path) as egress policy on both the port and VLAN:

  • Cisco Nexus 9300 and 9500 platform switches.

  • Cisco Nexus 9200 and 9300-EX platform switches; Cisco Nexus 93180YC-EX and 93108TC-EX switches; and the Cisco Nexus 9732C-EX line card.

  • The preceding is not supported for the following hardware: Cisco Nexus 9230QC, 9272Q, 9232C, 9236C, and 92300YC switches; and Cisco Nexus 9160YC-X switches.

• For VXLAN, the following Cisco Nexus platforms do not support QoS policies for traffic from the network to access direction (decapsulation path) as ingress policy on the uplink interface:

  • Cisco Nexus 9300 and 9500 platform switches.

  • Cisco Nexus 9200 and 9300-EX platform switches; and Cisco Nexus 93180YC-EX and 93108TC-EX switches; and the Cisco Nexus 9732C-EX line card.

  • Cisco Nexus 9230QC, 9272Q, 9232C, 9236C, and 92300YC switches; and Cisco Nexus 9160YC-X switches.

• QoS classification is not supported on the FEX interfaces ingressing the VXLAN traffic. This limitation is applicable to all Cisco Nexus 9000 series switches.

• Matching the packets based on DSCP, CoS, or precedence in Cisco Nexus 9300-EX platform switches, the TCAM entries for both IPv4 (single-wide is one entry) and IPv6 (double-wide are two entries) are installed in the hardware. For example, if you match DSCP 4, three entries are installed in the hardware, one entry for IPv4 and two entries for IPv6.

• You can specify a maximum of 1024 match criteria in a class map.

• You can configure a maximum of 128 classes for use in a single policy map.

• When you match on an ACL, the only other match you can specify is the Layer 3 packet length in a match-all class.

• The match-all option in the class-map type qos match-all command is not supported. The match criteria of this command becomes the same as in the class-map type qos match-any command. The class-map type qos match-all command yields the same results as the class-map type qos match-any command.

• The match-all option is not supported in CoPP class-map and it always defaults to the match-any option.

• You can classify traffic on Layer 2 ports that are based on either the port policy or VLAN policy of the incoming packet but not both. If both are present, the device acts on the port policy and ignores the VLAN policy.

• When a Cisco Nexus Fabric Extender (FEX) is connected and in use, do not mark data traffic with a CoS value of 7. CoS 7 is reserved for control traffic transiting the Fabric Extender.

• Control traffic (control frames) from the switch to the FEX are marked with a CoS value of 7 and are limited to a jumbo MTU frame size of 2344 bytes.

• FEX QoS policy supports FEX host interfaces (HIF).

  • QoS TCAM carving is supported on ALE (Application Leaf Engine) enabled switches.

  • Only system level policies are supported.

  • Match on CoS is supported.

  • Match on QoS-group is supported.

• Jumbo ping (MTU of 2400 or greater) from a switch supervisor with a COS of 7, to a FEX host, fails because the control queue on a FEX supports an MTU limited to 2240.

• QoS classification policies are not supported under system QoS for Layer 2 switch ports. However, you can configure a QoS policy to classify the incoming traffic based on CoS/DSCP and map it to different queues. The QoS policy must be applied under all the interfaces that require the classification.

• A QoS policy with a MAC-based ACL as a match in the class map does not work for IPv6 traffic. For QoS, IPv6 traffic must be matched based on IPv6 addresses and not on MAC addresses.

• As a best practice, avoid having a voice VLAN configuration where an access VLAN is same as the voice VLAN.

  The following are alternative approaches:

  • If a separate dot1p tag (cos) value is not required for voice traffic, use the switchport voice vlan untagged command.

    
    switch(config)# interface ethernet 1/1
    switch(config-if)# switchport access vlan 20
    switch(config-if)# switchport voice vlan untagged
    

  • If a separate cos value is required for voice traffic, use the switchport voice vlan dot1p command.

    
    switch(config)# interface ethernet 1/1
    switch(config-if)# switchport access vlan 20
    switch(config-if)# switchport voice vlan dot1p
    

• Cisco Nexus 9504 and Cisco Nexus 9508 switches with the following line cards do not support QoS match acl with fragments:

  • Cisco Nexus 96136YC-R

  • Cisco Nexus 9636C-RX

  • Cisco Nexus 9636Q-R

  • Cisco Nexus 9636C-R

• MPLS packets with a NULL label on transit nodes, receive an MPLS classification that is based on its NULL label EXP.

• Ingress DROP_ACL_DROP is seen with Cisco Nexus 9272Q, 9236C, and 92160YC-X switches on an ASIC during congestion. However, these drops do not impact the performance of the switch.

• A QoS policy that references an ACL that contains a match for ICMP type or code is not supported.

• A QoS Policy that references an ACL that contains a match for TCP flags is only supported on the following Cisco Nexus 9000 series switches:

  • Cisco Nexus 9200 platform switches

  • Cisco Nexus 9300-EX platform switches

  • Cisco Nexus 9300-FX platform switches

  • Cisco Nexus 9300-GX platform switches

  • Cisco Nexus 9500 platform switches with Cisco Nexus 97xx-EX and 97xx-FX line cards

  • Beginning with Cisco NX-OS Release 10.2(1q)F, QoS Classification is supported on the N9K-C9332D-GX2B platform switches.

• Beginning with Cisco NX-OS Release 10.3(1)F, QoS classification (ACL) is supported on the Cisco Nexus 9808 platform switches.

• Cisco Nexus 9808 platform switches have the following limitations for SUP QoS ACL support:

  • Egress type QoS policy is not supported.

  • policer re-marking is not supported for exceed-action and violate-action.

  • The match cos and set cos commands are not supported.

  • Max burst values are supported for 16 configs. QoS and CoPP shares these burst configs. CoPP reserves 8, and QoS will have remaining 8.

  • ACL counters are not available for the policer. The show system internal access-list interface eth <> input entries command will not show counters if it has policer.

  • 2-rate 3-color (2R3C) policing support is provided only for confirm action transmit and exceed action transmit.

  • Match on packet-length is not supported.

Use the show class-map command to verify the class-map configuration. This command displays all class maps.

The following example shows how to configure classification for two classes of traffic:

class-map class_dscp
match dscp af21, af32
exit
class-map class_cos
match cos 4, 5-6
exit