Courseiva
QoSPolicy-map Class Config

set dscp [value]

Sets the Differentiated Services Code Point (DSCP) value in the IP header for packets matching a class map in a policy map, used to mark traffic for QoS classification.

Definition: set dscp [value] is a Cisco IOS policy-map class config command. Sets the Differentiated Services Code Point (DSCP) value in the IP header for packets matching a class map in a policy map, used to mark traffic for QoS classification.

Overview

The `set dscp` command is a critical tool in Cisco IOS QoS policy-map configuration, used to mark packets with a specific Differentiated Services Code Point (DSCP) value in the IP header. DSCP is a 6-bit field in the IP packet header that enables differentiated services (DiffServ) QoS, allowing network devices to classify and prioritize traffic based on its marking. This command is typically applied within a policy map, which is attached to an interface or globally, and is used in conjunction with a class map that matches traffic based on criteria like ACLs, NBAR, or CoS.

The primary purpose is to re-mark traffic for downstream QoS policies, such as queuing, policing, or shaping. For example, voice traffic might be marked as EF (46) to ensure low latency, while bulk data might be marked as AF11 (10) for assured forwarding. The command is essential for implementing end-to-end QoS in enterprise networks, especially when traffic traverses multiple administrative domains.

Compared to alternatives like `set ip precedence` (which sets the 3-bit IP precedence field), `set dscp` offers finer granularity with 64 possible values (0-63) and better compatibility with modern DiffServ models. It is often used in conjunction with `set cos` for Layer 2 marking or `set qos-group` for internal marking. In the broader configuration workflow, the engineer first defines a class map to match traffic, then creates a policy map with the `set dscp` action, and finally applies the policy map to an interface using `service-policy`.

Important IOS behaviors: the command is available in policy-map class configuration mode (entered via `policy-map` and `class`), and it modifies the running configuration immediately; there is no buffered output. Privilege level 15 (enable) is required to enter global configuration mode. The command does not affect the packet's DSCP value until the policy is applied and traffic passes through the interface.

Misconfiguration can lead to incorrect QoS treatment, such as dropping high-priority traffic or allowing low-priority traffic to consume bandwidth. Understanding DSCP values and their standard meanings (e.g., EF, AF classes, CS) is crucial for effective use. The command is supported in Cisco IOS, IOS-XE, and IOS-XR (with slight syntax differences), but not directly in NX-OS (which uses `set dscp` in policy-map but with different class-map structure).

Syntax·Policy-map Class Config
set dscp [value]

When to Use This Command

  • Mark VoIP traffic with DSCP EF (46) to ensure low-latency queuing.
  • Set DSCP AF41 (34) for business-critical data to guarantee bandwidth.
  • Re-mark DSCP from default (0) to CS3 (24) for internal management traffic.
  • Apply DSCP marking to traffic from a specific subnet to differentiate service levels.

Parameters

ParameterSyntaxDescription
value<0-63> | af11 | af12 | af13 | af21 | af22 | af23 | af31 | af32 | af33 | af41 | af42 | af43 | cs1 | cs2 | cs3 | cs4 | cs5 | cs6 | cs7 | default | efThe DSCP value to set in the IP header. Can be a numeric value from 0 to 63, or a keyword representing standard DSCP codepoints: af11-af43 (Assured Forwarding classes), cs1-cs7 (Class Selector), default (0), ef (Expedited Forwarding, 46). Common mistakes include using a value outside 0-63, confusing DSCP with IP precedence (0-7), or using a keyword that doesn't match the intended QoS behavior (e.g., using ef for non-real-time traffic).

Command Examples

Mark VoIP traffic with DSCP EF

set dscp ef
Router(config-pmap-c)# set dscp ef
Router(config-pmap-c)#

The command sets DSCP to EF (46) for all packets matching the class. No output is shown; the prompt confirms the command is accepted.

Set DSCP AF41 for business-critical data

set dscp af41
Router(config-pmap-c)# set dscp af41
Router(config-pmap-c)#

Sets DSCP to AF41 (34) for assured forwarding class 4, low drop probability. No output is displayed.

Understanding the Output

The 'set dscp' command does not produce any output on the CLI; it simply configures the marking action within a policy-map class. To verify the configuration, use 'show policy-map [policy-name]' or 'show running-config | section policy-map'. In the policy-map output, you will see the class and its associated set dscp action.

For example: 'class VOICE set dscp ef'. The DSCP value can be specified by name (e.g., ef, af41, cs3) or by number (0-63). A correct configuration shows the DSCP value under the class; a missing or incorrect set command means no marking occurs.

In production, verify with 'show policy-map interface' to see actual packet counts and marking statistics.

Configuration Scenarios

Mark VoIP traffic with DSCP EF for priority queuing

A branch office needs to prioritize voice traffic (RTP) over data to ensure call quality. The network uses a class map to match RTP packets by UDP port range (16384-32767) and marks them with DSCP EF (46) for expedited forwarding.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create a class map to match voice traffic: class-map match-any VOICE
  3. 3.Step 3: Match RTP traffic by UDP port range: match udp 16384 32767
  4. 4.Step 4: Exit class-map configuration: exit
  5. 5.Step 5: Create a policy map: policy-map MARK_VOICE
  6. 6.Step 6: Associate the class map: class VOICE
  7. 7.Step 7: Set DSCP to EF: set dscp ef
  8. 8.Step 8: Exit policy-map configuration: exit
  9. 9.Step 9: Apply the policy map to the outbound interface: interface GigabitEthernet0/0
  10. 10.Step 10: Attach the service policy: service-policy output MARK_VOICE
Configuration
! Full IOS config block
class-map match-any VOICE
 match udp 16384 32767
!
policy-map MARK_VOICE
 class VOICE
  set dscp ef
!
interface GigabitEthernet0/0
 service-policy output MARK_VOICE

Verify: Use 'show policy-map interface GigabitEthernet0/0' to verify the policy is applied and packets are being marked. Look for 'Class: VOICE' and 'Marked dscp ef' counters incrementing.

Watch out: Ensure the class map matches the correct traffic direction. The policy is applied outbound, so only traffic leaving the interface is marked. For inbound marking, use 'service-policy input'.

Re-mark web traffic to DSCP AF21 for assured forwarding

An enterprise wants to give web traffic (HTTP/HTTPS) a higher drop probability than mission-critical traffic but still ensure delivery. They mark web traffic with DSCP AF21 (18) for assured forwarding class 2, low drop probability.

Topology

SW1(Gi1/0/1)---192.168.1.0/24---(Gi0/0)R1---10.0.0.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create an ACL to match web traffic: access-list 100 permit tcp any any eq www
  3. 3.Step 3: Create a class map: class-map match-all WEB
  4. 4.Step 4: Match the ACL: match access-group 100
  5. 5.Step 5: Exit class-map: exit
  6. 6.Step 6: Create a policy map: policy-map MARK_WEB
  7. 7.Step 7: Associate the class: class WEB
  8. 8.Step 8: Set DSCP to AF21: set dscp af21
  9. 9.Step 9: Exit policy-map: exit
  10. 10.Step 10: Apply to interface: interface GigabitEthernet0/0
  11. 11.Step 11: Attach service policy: service-policy input MARK_WEB
Configuration
! Full IOS config block
access-list 100 permit tcp any any eq www
!
class-map match-all WEB
 match access-group 100
!
policy-map MARK_WEB
 class WEB
  set dscp af21
!
interface GigabitEthernet0/0
 service-policy input MARK_WEB

Verify: Use 'show policy-map interface GigabitEthernet0/0' to see the policy. Check 'Class: WEB' for 'Marked dscp af21' packets. Also use 'show access-lists 100' to verify ACL matches.

Watch out: The ACL must be applied in the correct direction. If the policy is input, the ACL should match traffic entering the interface. Also, ensure the ACL does not inadvertently match other traffic; use specific ports.

Troubleshooting with This Command

When troubleshooting DSCP marking issues, the primary command is 'show policy-map interface [interface]' which displays the policy applied, class maps, and counters for matched and marked packets. Healthy output shows non-zero counters for the 'Marked dscp' field under the relevant class. If counters are zero, traffic is not matching the class map.

Verify the class map match criteria using 'show class-map [name]' and 'show access-lists' if ACLs are used. Common symptoms include: (1) No marking: check if the policy is applied to the correct interface and direction (input/output). Use 'show running-config interface [interface]' to confirm the 'service-policy' statement. (2) Incorrect DSCP value: use 'show policy-map [name]' to verify the set dscp value. (3) Traffic not matching: ensure the class map match statements are correct.

For NBAR, use 'show ip nbar protocol-discovery' to see if traffic is recognized. (4) Policy not taking effect: check if the interface is in the correct state (no shutdown) and if there are any QoS policy conflicts (e.g., multiple policies on the same interface). A step-by-step diagnostic flow: 1. Identify the interface and direction where marking should occur. 2.

Use 'show policy-map interface [interface] [input|output]' to see counters. 3. If no matches, examine the class map: 'show class-map [name]'. 4. If using ACLs, verify with 'show access-lists [number]' and generate test traffic. 5.

Use 'debug ip policy' (with caution) to see packets hitting the policy. 6. Check for any 'service-policy' statements that might override. Correlate with 'show ip interface' to see if the interface has any QoS features enabled.

Also, use 'show queueing interface [interface]' to see if DSCP-based queuing is active. Remember that DSCP marking is only effective if downstream devices trust the marking; otherwise, they may re-mark or ignore it. Use 'show mls qos' on switches to verify trust settings.

In summary, the key is to verify that traffic matches the class and that the policy is correctly applied; counters are the most reliable indicator.

CCNA Exam Tips

1.

CCNA 200-301 expects you to know DSCP values: EF=46, AF41=34, CS3=24, default=0.

2.

Remember that 'set dscp' is configured in policy-map class config mode, not globally.

3.

The exam may ask which DSCP value to use for VoIP: always EF (46).

4.

Be able to distinguish between 'set dscp' and 'set precedence'—DSCP is more granular.

Common Mistakes

Using 'set dscp' in global config mode instead of policy-map class config mode.

Typing an invalid DSCP name (e.g., 'ef1' instead of 'ef') or number outside 0-63.

Forgetting to apply the policy-map to an interface with 'service-policy' command.

set dscp [value] vs policy-map [name]

The 'policy-map' command creates the QoS policy container, while 'set dscp' is an action applied to a specific traffic class within that policy. They are commonly confused because set dscp is configured in policy-map class configuration mode, leading engineers to mix up the container and its contents.

Aspectset dscp [value]policy-map [name]
ScopeAction (marking) within a single classContainer for multiple class maps and actions
Configuration modePolicy-map class config (config-pmap-c)Global config (config)#
DependenciesRequires an existing policy-map and class mapIs a parent object; class maps and actions are nested under it
Effect on trafficImmediately modifies DSCP in IP header for matched packetsDefines which traffic gets which actions; by itself does nothing
Typical usageInside a class to mark traffic for downstream QoS or trust boundariesTo build a complete QoS service policy (e.g., shaping, priority)
PersistencePart of running config but only effective when policy-map is applied to an interfaceStored in running config; must be applied to an interface with 'service-policy'

Use set dscp [value] when you need to mark specific traffic classes with a DSCP value for differentiated treatment or trust boundaries.

Use policy-map [name] when you need to create a set of QoS actions (like marking, queuing, policing) for multiple traffic classes.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the `set dscp` command syntax is identical to classic IOS, but the verification commands may differ slightly. For example, 'show policy-map interface' output includes additional fields like 'QoS Set' and 'DSCP'. In NX-OS (e.g., Nexus switches), the equivalent command is also `set dscp` within a policy-map, but the class-map configuration uses a different structure (e.g., 'class-map type qos match-all').

NX-OS also supports 'set dscp' in policy-map type qos, and verification is done via 'show policy-map interface [interface]' or 'show policy-map system'. There is no direct ASA equivalent; ASA uses modular policy framework (MPF) with 'set dscp' in a policy-map, but the syntax is similar to IOS. In IOS-XR, the command is `set dscp` under a policy-map, but the configuration is done in XR-specific modes (e.g., 'policy-map type qos').

The output format in XR is different, often using XML or structured output. Behavior differences across IOS versions: In older IOS 12.x, the command was available but some DSCP keywords (like af11) might not be recognized; numeric values are always safe. In IOS 15.x and 16.x, all standard keywords are supported.

The command is present in all modern IOS versions. For switches running IOS (e.g., Catalyst 3750), the command is available but may require 'mls qos' to be enabled globally. In IOS-XE 16.x, the command works with both 'match' and 'set' in the same policy-map.

Always check the specific platform documentation for any nuances.

Related Commands

policy-map [name]

Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.

service-policy

Attaches a QoS policy map to an interface in the input or output direction, activating traffic classification, marking, queuing, policing, and shaping defined in the policy map.

show policy-map

Displays the configuration and statistics of all policy maps applied to interfaces, used to verify QoS policies and monitor traffic class counters.

show policy-map interface

Displays the current QoS policy applied to an interface, including per-class statistics such as packets matched, bytes, and actions taken, used to verify and troubleshoot QoS configurations.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions