qos policy configuration

[ydeschoe]

Gents,

I'm setting up a qos policy to allow access to the mgmt ip address from the swicth from a certain ip address and this limited to some specified ip service ports, at the same time for all other devices I deny the communication for all the specified services

policy network group mgmt-pc x.x.x.x
policy service telnet protocol 6 destination ip port 23
policy service ftp protocol 6 destination ip port 20-21
policy service ssh protocol 6 destination ip port 22
policy service snmp protocol 6 destination ip port 161
policy service http protocol 6 destination ip port 80
policy service https protocol 6 destination ip port 443
policy service group access_protocol ftp snmp ssh telnet http https
policy condition allow_mgmt source network group mgmt-pc destination network group Switch service group access_protocol
policy condition deny_mgmt source ip Any destination network group Switch service group access_protocol
policy action allow_mgmt
policy action deny_mgmt disposition deny
policy rule allow_mgmt precedence 100 condition allow_mgmt action allow_mgmt
policy rule deny_mgmt precedence 10 condition deny_mgmt action deny_mgmt
qos apply

The reason for the service specification is that I don't want to put all the switches their ip addresses into the netwok group of each switch to allow ospf and vrrp, ....

the problem I have is that after a certain period of time I can't access the switch anymore via my specified services, but device is still pingable

the os version I use is 6.3.1.1176.R01 on a 6800

thanks for your reaction