Cisco ASA QOS

In the following example, the class-map command classifies all non-tunneled TCP traffic, using an access list named tcp_traffic:

hostname(config)# access-list tcp_traffic permit tcp any any

hostname(config)# class-map tcp_traffic

hostname(config-cmap)# match access-list tcp_traffic


In the following example, other, more specific match criteria are used for classifying traffic for specific, security-related tunnel groups. These specific match criteria stipulate that a match on tunnel-group (in this case, the previously-defined Tunnel-Group-1) is required as the first match characteristic to classify traffic for a specific tunnel, and it allows for an additional match line to classify the traffic (IP differential services code point, expedited forwarding).

hostname(config)# class-map TG1-voice

hostname(config-cmap)# match tunnel-group tunnel-grp1

hostname(config-cmap)# match dscp ef


In the following example, the class-map command classifies both tunneled and non-tunneled traffic according to the traffic type:

hostname(config)# access-list tunneled extended permit ip 10.10.34.0 255.255.255.0 
192.168.10.0 255.255.255.0

hostname(config)# access-list non-tunneled extended permit tcp any any

hostname(config)# tunnel-group tunnel-grp1 type IPsec_L2L


hostname(config)# class-map browse

hostname(config-cmap)# description "This class-map matches all non-tunneled tcp traffic."  

hostname(config-cmap)# match access-list non-tunneled


hostname(config-cmap)# class-map TG1-voice

hostname(config-cmap)# description "This class-map matches all dscp ef traffic for   
tunnel-grp 1."  

hostname(config-cmap)# match dscp ef

hostname(config-cmap)# match tunnel-group tunnel-grp1


hostname(config-cmap)# class-map TG1-BestEffort

hostname(config-cmap)# description "This class-map matches all best-effort traffic for   
tunnel-grp1."  

hostname(config-cmap)# match tunnel-group tunnel-grp1

hostname(config-cmap)# match flow ip destination-address


The following example shows a way of policing a flow within a tunnel, provided the classed traffic is not specified as a tunnel, but does go through the tunnel. In this example, 192.168.10.10 is the address of the host machine on the private side of the remote tunnel, and the access list is named "host-over-l2l". By creating a class-map (named "host-specific"), you can then police the "host-specific" class before the LAN-to-LAN connection polices the tunnel. In this example, the "host-specific" traffic is rate-limited before the tunnel, then the tunnel is rate-limited:  

hostname(config)# access-list host-over-l2l extended permit ip any host 192.168.10.10

hostname(config)# class-map host-specific

hostname(config-cmap)# match access-list host-over-l2l


The following example builds on the configuration developed in the previous section. As in the previous example, there are two named class-maps: tcp_traffic and TG1-voice.

hostname(config)# class-map TG1-best-effort

hostname(config-cmap)# match tunnel-group Tunnel-Group-1

hostname(config-cmap)# match flow ip destination-address


Adding a third class map provides a basis for defining a tunneled and non-tunneled QoS policy, as follows, which creates a simple QoS policy for tunneled and non-tunneled traffic, assigning packets of the class TG1-voice to the low latency queue and setting rate limits on the tcp_traffic and TG1-best-effort traffic flows.

Example 57-2 Priority and Policing Example

In this example, the maximum rate for traffic of the tcp_traffic class is 56,000 bits/second and a maximum burst size of 10,500 bytes per second. For the TC1-BestEffort class, the maximum rate is 200,000 bits/second, with a maximum burst of 37,500 bytes/second. Traffic in the TC1-voice class has no policed maximum speed or burst rate because it belongs to a priority class.

hostname(config)# access-list tcp_traffic permit tcp any any

hostname(config)# class-map tcp_traffic

hostname(config-cmap)# match access-list tcp_traffic


hostname(config)# class-map TG1-voice

hostname(config-cmap)# match tunnel-group tunnel-grp1

hostname(config-cmap)# match dscp ef


hostname(config-cmap)# class-map TG1-BestEffort

hostname(config-cmap)# match tunnel-group tunnel-grp1

hostname(config-cmap)# match flow ip destination-address


hostname(config)# policy-map qos

hostname(config-pmap)# class tcp_traffic

hostname(config-pmap-c)# police output 56000 10500


hostname(config-pmap-c)# class TG1-voice

hostname(config-pmap-c)# priority


hostname(config-pmap-c)# class TG1-best-effort

hostname(config-pmap-c)# police output 200000 37500


hostname(config-pmap-c)# class class-default

hostname(config-pmap-c)# police output 1000000 37500


hostname(config-pmap-c)# service-policy qos global