23-13
Cisco ASA Series Firewall CLI Configuration Guide
Chapter23 Configuring QoS
Configuring QoS
Example2 3-2 Priority and Policing Example
In this example, the maximum rate for traffic of the tcp_traffic class is 56,000 bits/second and a
maximum burst size of 10,500 bytes per second. For the TC1-BestEffort class, the maximum rate is
200,000 bits/second, with a maximum burst of 37,500 bytes/second. Traffic in the TC1-voice class has
no policed maximum speed or burst rate because it belongs to a priority class.
ciscoasa(config)# access-list tcp_traffic permit tcp any any
ciscoasa(config)# class-map tcp_traffic
ciscoasa(config-cmap)# match access-list tcp_traffic
ciscoasa(config)# class-map TG1-voice
ciscoasa(config-cmap)# match tunnel-group tunnel-grp1
ciscoasa(config-cmap)# match dscp ef
ciscoasa(config-cmap)# class-map TG1-BestEffort
ciscoasa(config-cmap)# match tunnel-group tunnel-grp1
ciscoasa(config-cmap)# match flow ip destination-address
ciscoasa(config)# policy-map qos
ciscoasa(config-pmap)# class tcp_traffic
ciscoasa(config-pmap-c)# police output 56000 10500
ciscoasa(config-pmap-c)# class TG1-voice
ciscoasa(config-pmap-c)# priority
ciscoasa(config-pmap-c)# class TG1-best-effort
ciscoasa(config-pmap-c)# police output 200000 37500
ciscoasa(config-pmap-c)# class class-default
ciscoasa(config-pmap-c)# police output 1000000 37500
ciscoasa(config-pmap-c)# service-policy qos global
Configuring a Service Rule for Traffic Shaping and Hierarchical Priority Queuing
You can configure traffic shaping for all traffic on an interface, and optionally hierarchical priority
queuing for a subset of latency-sensitive traffic.
This section includes the following topics:
•(Optional) Configuring the Hierarchical Priority Queuing Policy, page23-13
•Configuring the Service Rule, page23-14

(Optional) Configuring the Hierarchical Priority Queuing Policy

You can optionally configure priority queuing for a subset of latency-sensitive traffic.
Guidelines
•One side-effect of priority queuing is packet re-ordering. For IPsec packets, out-of-order packets
that are not within the anti-replay window generate warning syslog messages. These warnings are
false alarms in the case of priority queuing. You can configure the IPsec anti-replay window size to
avoid possible false alarms. See the crypto ipsec security-association replay command in the
command reference.