23-14
Cisco ASA Series Firewall CLI Configuration Guide
Chapter23 Configuring QoS
Configuring QoS
•For hierarchical priority queuing, you do not need to create a priority queue on an interface.
Restrictions
•For hierarchical priority queuing, for encrypted VPN traffic, you can only match traffic based on the
DSCP or precedence setting; you cannot match a tunnel group.
•For hierarchical priority queuing, IPsec-over-TCP traffic is not supported.
Detailed Steps
Configuring the Service Rule
To configure traffic shaping and optional hiearchical priority queuing, perform the following steps.
Restrictions
•Traffic shaping is only supported on the ASA 5505, 5510, 5520, 5540, and 5550. Multi-core models
(such as the ASA 5500-X) do not support shaping.
•For traffic shaping, you can only use the class-default class map, which is automatically created by
the ASA, and which matches all traffic.
Command Purpose
Step1 class-map priority_map_name
Example:
ciscoasa(config)# class-map
priority_traffic
For hierarchical priority queuing, creates a class map to identify
the traffic for which you want to perform priority queuing.
Step2 match parameter
Example:
ciscoasa(config-cmap)# match access-list
priority
Specifies the traffic in the class map. See the “Identifying Traffic
(Layer 3/4 Class Maps)” section on page 1-12 for more
information. For encrypted VPN traffic, you can only match
traffic based on the DSCP or precedence setting; you cannot
match a tunnel group.
Step3 policy-map priority_map_name
Example:
ciscoasa(config)# policy-map
priority-sub-policy
Creates a policy map.
Step4 class priority_map_name
Example:
ciscoasa(config-pmap)# class
priority-sub-map
Specifies the class map you created in Step 1.
Step5 priority
Example:
ciscoasa(config-pmap-c)# priority
Applies the priority queuing action to a class map.
Note This policy has not yet been activated. You must activate
it as part of the shaping policy. See the “Configuring the
Service Rule” section on page23-14.