Network ingress IP match criteria

IP match criteria classification is supported in the ingress section of a network QoS policy.

The classification only applies to the outer IPv4 header of non-tunneled traffic. Consequently, the use of an IP criteria statement in a network QoS policy is ignored for received traffic when the network QoS policy is applied on the ingress network IP interface in the following cases:

• mesh SDPs in VPLS services

• spoke SDPs in VPLS and Xpipe services

• spoke SDPs under an IP interface in an IES or VPRN service

• spoke SDPs in a VPRN service

• bindings created automatically by the auto-bind-tunnel command in a VPRN service

• IPv6 over IPv4 tunnels

• VXLAN bindings (egress VTEP, VNI)

The only exception is for traffic received on a Draft Rosen tunnel, for which classification on the outer IP header only is supported.

Attempting to apply a network QoS policy containing an IP criteria statement to any object except a network IP interface results in an error.

The following is an example configuration:

  configure
     qos
        network 10 name ‟10” create
            ingress
                ip-criteria
                    entry 10 create
                        match
                            dst-ip 10.0.0.1/32
                        exit
                        action fc "h2" profile in
                    exit
                exit
            exit
        exit
     exit