Classification is the separation of packets into traffic classes. You configure the device to take a specific action on the specified classified traffic, such as policing or marking down, or other actions.

You can create class maps to represent each traffic class by matching packet characteristics with the classification criteria in the following table:

You can specify multiple match criteria, you can choose to not match on a particular criterion, or you can determine the traffic class by matching any or all criteria.

Note	However, if you match on an ACL, no other match criteria, except the packet length, can be specified in a match-all class. In a match-any class, you can match on ACLs and any other match criteria.

Traffic that fails to match any class in a QoS policy map is assigned to a default class of traffic called class-default. The class-default can be referenced in a QoS policy map to select this unmatched traffic.

You can reuse class maps when defining the QoS policies for different interfaces that process the same types of traffic.

Classification has the following prerequisites:

• You must be familiar with using modular QoS CLI.

• You are logged on to the device.

Classification has the following configuration guidelines and limitations:

• QoS policy can be attached to individual interfaces or to the port channels for input or output traffic.

• Beginning with Cisco Nexus NX-OS Release 7.0(3)I7(9), the Cisco Nexus 9504 switch with the Cisco Nexus 9464PX or 9464TX line card supports DSCP wildcard mask.

• The show commands with the internal keyword are not supported.

• When the destination interface sup-eth0 CLI command is configured, the following system log message is displayed: Enabling span destination to SUP will affect ingress QoS classification.

• For VXLAN, beginning Cisco NX-OS Release 7.0(3)I6(1), the following Cisco Nexus switches support QoS policies for traffic in the network to host direction (decapsulation path) as egress policy on both the port and VLAN:

  • Cisco Nexus 9300 and 9500 platform switches.

  • Cisco Nexus 9200 and 9300-EX platform switches; Cisco Nexus 93180YC-EX and 93108TC-EX switches; and the Cisco Nexus 9732C-EX line card.

  • The above is not supported for the following hardware: Cisco Nexus 9230QC, 9272Q, 9232C, 9236C, and 92300YC switches; and Cisco Nexus 9160YC-X switches.

• For VXLAN, beginning Cisco NX-OS Release 7.0(3)I6(1), the following Cisco Nexus switches do not support QoS policies for traffic from the network to access direction (decapsulation path) as ingress policy on the uplink interface:

  • Cisco Nexus 9300 and 9500 platform switches.

  • Cisco Nexus 9200 and 9300-EX platform switches; and Cisco Nexus 93180YC-EX and 93108TC-EX switches; and the Cisco Nexus 9732C-EX line card.

  • Cisco Nexus 9230QC, 9272Q, 9232C, 9236C, and 92300YC switches; and Cisco Nexus 9160YC-X switches.

• QoS classification is not supported on the FEX interfaces ingressing the VXLAN traffic. This limitation is applicable to all Cisco Nexus 9000 Series switches.

• For matching the packets based on DSCP, CoS, or precedence in Cisco Nexus 9300-EX platform switches, the TCAM entries for both IPv4 (single-wide is 1 entry) and IPv6 (double-wide are 2 entries) are installed in the hardware. For example, if you match DSCP 4, 3 entries are installed in the hardware, 1 entry for IPv4 and 2 entries for IPv6.

• You can specify a maximum of 1024 match criteria in a class map.

• You can configure a maximum of 128 classes for use in a single policy map.

• When you match on an ACL, the only other match you can specify is the Layer 3 packet length in a match-all class.

• The match-all option in the class-map type qos match-all command is not supported. The match criteria of this command becomes the same as in the class-map type qos match-any command. The class-map type qos match-all command yields the same results as the class-map type qos match-any command.

• You can classify traffic on Layer 2 ports based on either the port policy or VLAN policy of the incoming packet but not both. If both are present, the device acts on the port policy and ignores the VLAN policy.

• When a Cisco Nexus Fabric Extender (FEX) is connected and in use, data traffic should not be marked with a CoS value of 7. CoS 7 is reserved for control traffic transiting the Fabric Extender.

• Control traffic (control frames) from the switch to the FEX are marked with a CoS value of 7 and are limited to a jumbo MTU frame size of 2344 bytes.

• FEX host interfaces (HIF) are supported by the FEX QoS policy.

  • QoS TCAM carving is supported on ALE (Application Leaf Engine) enabled switches.

  • Only system level policies are supported.

  • Match on CoS is supported.

  • Match on QoS-group is supported.

• A jumbo ping (MTU of 2400 or greater) from a switch supervisor with a COS of 7 to a FEX host fails because the control queue on a FEX supports an MTU limited to 2240.

• QoS classification policies are not supported under system qos for Layer 2 switch ports. However, you can configure a QoS policy to classify the incoming traffic based on CoS/DSCP and map it to different queues. The QoS policy needs to be applied under all the interfaces that require the classification.

• A QoS policy with a MAC-based ACL as a match in the class map does not work for IPv6 traffic. For QoS, IPv6 traffic needs to be matched based on IPv6 addresses and not on MAC addresses. (7.0(3)F3(3) and later 7.0(3)F3(x) releases)

• As a best practice, avoid having a voice VLAN configuration where an access VLAN is same as the voice VLAN.

  The following are alternative approaches:

  • If a separate dot1p tag (cos) value is not required for voice traffic, use the switchport voice vlan untagged command.

    
    switch(config)# interface ethernet 1/1
    switch(config-if)# switchport access vlan 20
    switch(config-if)# switchport voice vlan untagged
    

  • If a separate cos value is required for voice traffic, use the switchport voice vlan dot1p command.

    
    switch(config)# interface ethernet 1/1
    switch(config-if)# switchport access vlan 20
    switch(config-if)# switchport voice vlan dot1p
    

• Cisco Nexus 9504 and Cisco Nexus 9508 switches with the following line cards do not support QoS match acl with fragments:

  • Cisco Nexus 96136YC-R

  • Cisco Nexus 9636C-RX

  • Cisco Nexus 9636Q-R

  • Cisco Nexus 9636C-R

• Ingress DROP_ACL_DROP is seen with Cisco Nexus 9272Q, 9236C, and 92160YC-X switches on an ASIC during congestion. However, these drops do not impact the performance of the switch.

• MPLS packets with a NULL label on transit nodes, receive an MPLS classification based on its NULL label EXP.

• Ingress DROP_ACL_DROP is seen with Cisco Nexus 9272Q, 9236C, and 92160YC-X switches on an ASIC during congestion. However, these drops do not impact the performance of the switch.

Use the show class-map command to verify the class-map configuration. This command displays all class maps.

The following example shows how to configure classification for two classes of traffic:

class-map class_dscp
match dscp af21, af32
exit
class-map class_cos
match cos 4, 5-6
exit