Cisco Systems ASA 5505, ASA 5545-X, ASA 5555-X, ASA 5585-X, ASA 5580 manual 23-12

Chapter 23 Configuring QoS

Configuring QoS

ciscoasa(config)# class-map tcp_traffic ciscoasa(config-cmap)#match access-list tcp_traffic

In the following example, other, more specific match criteria are used for classifying traffic for specific, security-related tunnel groups. These specific match criteria stipulate that a match on tunnel-group (in this case, the previously-defined Tunnel-Group-1) is required as the first match characteristic to classify traffic for a specific tunnel, and it allows for an additional match line to classify the traffic (IP differential services code point, expedited forwarding).

ciscoasa(config)# class-map TG1-voice

ciscoasa(config-cmap)#match tunnel-group tunnel-grp1

ciscoasa(config-cmap)# match dscp ef

In the following example, the class-mapcommand classifies both tunneled and non-tunneled traffic according to the traffic type:

ciscoasa(config)# access-list tunneled extended permit ip 10.10.34.0 255.255.255.0 192.168.10.0 255.255.255.0

ciscoasa(config)# access-list non-tunneled extended permit tcp any any ciscoasa(config)# tunnel-group tunnel-grp1 type IPsec_L2L

ciscoasa(config)# class-map browse

ciscoasa(config-cmap)#description "This class-map matches all non-tunneled tcp traffic." ciscoasa(config-cmap)#match access-list non-tunneled

ciscoasa(config-cmap)# class-mapTG1-voice

ciscoasa(config-cmap)#description "This class-map matches all dscp ef traffic for tunnel-grp 1."

ciscoasa(config-cmap)# match dscp ef ciscoasa(config-cmap)# match tunnel-grouptunnel-grp1

ciscoasa(config-cmap)#class-map TG1-BestEffort

ciscoasa(config-cmap)#description "This class-map matches all best-effort traffic for

tunnel-grp1."

ciscoasa(config-cmap)#match tunnel-group tunnel-grp1 ciscoasa(config-cmap)#match flow ip destination-address

The following example shows a way of policing a flow within a tunnel, provided the classed traffic is not specified as a tunnel, but does go through the tunnel. In this example, 192.168.10.10 is the address of the host machine on the private side of the remote tunnel, and the ACL is named “host-over-l2l”. By creating a class-map (named “host-specific”), you can then police the “host-specific” class before the LAN-to-LAN connection polices the tunnel. In this example, the “host-specific” traffic is rate-limited before the tunnel, then the tunnel is rate-limited:

ciscoasa(config)# access-list host-over-l2l extended permit ip any host 192.168.10.10 ciscoasa(config)# class-map host-specific

ciscoasa(config-cmap)#match access-list host-over-l2l

The following example builds on the configuration developed in the previous section. As in the previous example, there are two named class-maps: tcp_traffic and TG1-voice.

ciscoasa(config)# class-map TG1-best-effort ciscoasa(config-cmap)#match tunnel-group Tunnel-Group-1 ciscoasa(config-cmap)#match flow ip destination-address

Adding a third class map provides a basis for defining a tunneled and non-tunneled QoS policy, as follows, which creates a simple QoS policy for tunneled and non-tunneled traffic, assigning packets of the class TG1-voice to the low latency queue and setting rate limits on the tcp_traffic and TG1-best-effort traffic flows.

Cisco ASA Series Firewall CLI Configuration Guide

23-12