Quality of Service | 859Determine the order in which ACLs are used to classify trafficWhen you link class-maps to queues using the command service-queue, FTOS matches the class-mapsaccording to queue priority (queue numbers closer to 0 have lower priorities). For example, inFigure 41-10, class-map cmap2 is matched against ingress packets before cmap1.ACLs acl1 and acl2 have overlapping rules because the address range 20.1.1.0/24 is within 20.0.0.0/8.Therefore, (without the keyword order) packets within the range 20.1.1.0/24 match positive against cmap1and are buffered in queue 7, though you intended for these packets to match positive against cmap2 and bebuffered in queue 4.In cases such as these, where class-maps with overlapping ACL rules are applied to different queues, usethe order keyword to specify the order in which you want to apply ACL rules, as shown in Figure 41-10.The order can range from 0 to 254. FTOS writes to the CAM ACL rules with lower order numbers (ordernumbers closer to 0) before rules with higher order numbers so that packets are matched as you intended.By default, all ACL rules have an order of 254.Set DSCP values for egress packets based on flowMatch-any Layer 3 flows may have several match criteria. All flows that match at least one of the matchcriteria are mapped to the same queue since they are in the same class map. Setting a DSCP value fromQOS-POLICY-IN mode (see Set a DSCP value for egress packets on page 861) assigns the same DSCPvalue to all of the matching flows in the class-map. The Flow-based DSCP Marking feature allows you toassign different DSCP to each match criteria CLASS-MAP mode using the option set-ip-dscp with thematch command so that matching flows within a class map can have different DSCP values, as shown inFigure 41-11. The values you set from CLASS-MAP mode override the value you QoS input policy DSCPvalue, and packets matching the rule are marked with the specified value.Figure 41-11. Marking Flows in the Same Queue with Different DSCP ValuesDisplay configured class maps and match criteriaDisplay all class-maps or a specific class map using the command show qos class-map from EXECPrivilege mode.FTOS#show run class-map!class-map match-any example-flowbased-dscpmatch ip access-group test set-ip-dscp 2match ip access-group test1 set-ip-dscp 4match ip precedence 7 set-ip-dscp 1FTOS#show run qos-policy-input!qos-policy-input flowbasedset ip-dscp 3FTOS# show cam layer3 linecard 2 port-set 0Cam Port Dscp Proto Tcp Src Dst SrcIp DstIp DSCP QueueIndex Flag Port Port Marking------------------------------------------------------------------------------------------------16260 1 0 TCP 0x0 0 0 1.1.1.0/24 0.0.0.0/0 2 016261 1 0 UDP 0x0 0 0 2.2.2.2/32 0.0.0.0/0 4 016262 1 56 0 0x0 0 0 0.0.0.0/0 0.0.0.0/0 1 024451 1 0 0 0x0 0 0 0.0.0.0/0 0.0.0.0/0 - 0
