23-14
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 23 Configuring QoS
Configuring QoS
• For hierarchical priority queuing, you do not need to create a priority queue on an interface.
Restrictions
• For hierarchical priority queuing, for encrypted VPN traffic, you can only match traffic based on the
DSCP or precedence setting; you cannot match a tunnel group.
• For hierarchical priority queuing, IPsec-over-TCP traffic is not supported.
Detailed Steps
Configuring the Service Rule
To configure traffic shaping and optional hiearchical priority queuing, perform the following steps.
Restrictions
• Traffic shaping is only supported on the ASA 5505, 5510, 5520, 5540, and 5550. Multi-core models
(such as the ASA 5500-X) do not support shaping.
• For traffic shaping, you can only use the class-default class map, which is automatically created by
the ASA, and which matches all traffic.
Command Purpose
Step 1
class-map priority_map_name
Example:
ciscoasa(config)# class-map
priority_traffic
For hierarchical priority queuing, creates a class map to identify
the traffic for which you want to perform priority queuing.
Step 2
match parameter
Example:
ciscoasa(config-cmap)# match access-list
priority
Specifies the traffic in the class map. See the “Identifying Traffic
(Layer 3/4 Class Maps)” section on page 1-12 for more
information. For encrypted VPN traffic, you can only match
traffic based on the DSCP or precedence setting; you cannot
match a tunnel group.
Step 3
policy-map priority_map_name
Example:
ciscoasa(config)# policy-map
priority-sub-policy
Creates a policy map.
Step 4
class priority_map_name
Example:
ciscoasa(config-pmap)# class
priority-sub-map
Specifies the class map you created in Step 1.
Step 5
priority
Example:
ciscoasa(config-pmap-c)# priority
Applies the priority queuing action to a class map.
Note This policy has not yet been activated. You must activate
it as part of the shaping policy. See the “Configuring the
Service Rule” section on page 23-14.
