Hello Rene,
I was very happy to find you had a lab on this subject. I went through this myself and everything worked as described, except one area. When I moved the service policy off the FA0/0 interface and put it on the Tunnel 0 interface (and removed the qos pre-qualify from the tunnel), the encapsulated IP header had the CS5 markings, but the outer header did not (as seen below)
Outer:
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Inner:
Differentiated Services Field: 0xa0 (DSCP 0x28: Class Selector 5; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
If I check the output from show policy-map interface tunnel 0, it shows my “interesting” traffic being identified and marked.
With no service policy applied, if I do the extended ping commands (as you did), then both IP headers are marked with CS5 as expected.
The only deviation I had from your lab was to use a policy-map set command of “set dscp cs5” instead of a police command
R1#sh policy-map
Policy Map PM_ICMP
Class CM_ICMP
set dscp cs5
Odd, huh?