diff --git a/python/vyos/qos/base.py b/python/vyos/qos/base.py
index 98e486e42b..322cdca449 100644
--- a/python/vyos/qos/base.py
+++ b/python/vyos/qos/base.py
@@ -248,6 +248,8 @@ def update(self, config, direction, priority=None):
 
                 if 'match' in cls_config:
                     has_filter = False
+                    has_action_policy = any(tmp in ['exceed', 'bandwidth', 'burst'] for tmp in cls_config)
+                    max_index = len(cls_config['match'])
                     for index, (match, match_config) in enumerate(cls_config['match'].items(), start=1):
                         filter_cmd = filter_cmd_base
                         if not has_filter:
@@ -335,15 +337,16 @@ def update(self, config, direction, priority=None):
                                     elif af == 'ipv6':
                                         filter_cmd += f' match u8 {mask} {mask} at 53'
 
-                                cls = int(cls)
-                                filter_cmd += f' flowid {self._parent:x}:{cls:x}'
-                                self._cmd(filter_cmd)
+                        if index != max_index or not has_action_policy:
+                            # avoid duplicate last match rule
+                            cls = int(cls)
+                            filter_cmd += f' flowid {self._parent:x}:{cls:x}'
+                            self._cmd(filter_cmd)
 
                     vlan_expression = "match.*.vif"
                     match_vlan = jmespath.search(vlan_expression, cls_config)
 
-                    if any(tmp in ['exceed', 'bandwidth', 'burst'] for tmp in cls_config) \
-                        and has_filter:
+                    if has_action_policy and has_filter:
                         # For "vif" "basic match" is used instead of "action police" T5961
                         if not match_vlan:
                             filter_cmd += f' action police'