Filter
Top Products
23-12
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 23 Configuring QoS
Configuring QoS
ciscoasa(config)# class-map tcp_traffic
ciscoasa(config-cmap)# match access-list tcp_traffic
In the following example, other, more specific match criteria are used for classifying traffic for specific,
security-related tunnel groups. These specific match criteria stipulate that a match on tunnel-group (in
this case, the previously-defined Tunnel-Group-1) is required as the first match characteristic to classify
traffic for a specific tunnel, and it allows for an additional match line to classify the traffic (IP differential
services code point, expedited forwarding).
ciscoasa(config)# class-map TG1-voice
ciscoasa(config-cmap)# match tunnel-group tunnel-grp1
ciscoasa(config-cmap)# match dscp ef
In the following example, the class-map command classifies both tunneled and non-tunneled traffic
according to the traffic type:
ciscoasa(config)# access-list tunneled extended permit ip 10.10.34.0 255.255.255.0
192.168.10.0 255.255.255.0
ciscoasa(config)# access-list non-tunneled extended permit tcp any any
ciscoasa(config)# tunnel-group tunnel-grp1 type IPsec_L2L
ciscoasa(config)# class-map browse
ciscoasa(config-cmap)# description "This class-map matches all non-tunneled tcp traffic."
ciscoasa(config-cmap)# match access-list non-tunneled
ciscoasa(config-cmap)# class-map TG1-voice
ciscoasa(config-cmap)# description "This class-map matches all dscp ef traffic for
tunnel-grp 1."
ciscoasa(config-cmap)# match dscp ef
ciscoasa(config-cmap)# match tunnel-group tunnel-grp1
ciscoasa(config-cmap)# class-map TG1-BestEffort
ciscoasa(config-cmap)# description "This class-map matches all best-effort traffic for
tunnel-grp1."
ciscoasa(config-cmap)# match tunnel-group tunnel-grp1
ciscoasa(config-cmap)# match flow ip destination-address
The following example shows a way of policing a flow within a tunnel, provided the classed traffic is
not specified as a tunnel, but does go through the tunnel. In this example, 192.168.10.10 is the address
of the host machine on the private side of the remote tunnel, and the ACL is named “host-over-l2l”. By
creating a class-map (named “host-specific”), you can then police the “host-specific” class before the
LAN-to-LAN connection polices the tunnel. In this example, the “host-specific” traffic is rate-limited
before the tunnel, then the tunnel is rate-limited:
ciscoasa(config)# access-list host-over-l2l extended permit ip any host 192.168.10.10
ciscoasa(config)# class-map host-specific
ciscoasa(config-cmap)# match access-list host-over-l2l
The following example builds on the configuration developed in the previous section. As in the previous
example, there are two named class-maps: tcp_traffic and TG1-voice.
ciscoasa(config)# class-map TG1-best-effort
ciscoasa(config-cmap)# match tunnel-group Tunnel-Group-1
ciscoasa(config-cmap)# match flow ip destination-address
Adding a third class map provides a basis for defining a tunneled and non-tunneled QoS policy, as
follows, which creates a simple QoS policy for tunneled and non-tunneled traffic, assigning packets of
the class TG1-voice to the low latency queue and setting rate limits on the tcp_traffic and
TG1-best-effort traffic flows.