Cisco 500 Series, Configuration Manual

Page: 453 / 1140

24-5
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 24 Applying QoS Policies
Defining a QoS Policy Map
hostname(config)# access-list host-over-l2l extended permit ip any host 192.168.10.10
hostname(config)# class-map host-specific
hostname(config-cmap)# match access-list host-over-l2l
The following table summarizes the match command criteria available and relevant to QoS. For the full
list of all match commands and their syntax, see Cisco Security Appliance Command Reference :
In addition to the user-defined classes, a system-defined class named class-default also exists. This
class-default represents all packets that do not match any of the user-defined classes, so that policies can
be defined for these packets.
Defining a QoS Policy Map
The policy-map command configures various policies, such as security policies or QoS policies. A
policy is an association of a traffic class, specified by a class command, and one or more actions. This
section specifically deals with using the policy-map command to define the QoS policies for one or more
classes of packets.
When you enter a policy-map command you enter the policy-map configuration mode, and the prompt
changes to indicate this. In this mode, you can enter class and description commands. A policy-map
command can specify multiple policies. The maximum number of policy maps is 64.
After entering the policy-map command, you then enter a class command to specify the classification
of the packet traffic. The class command configures QoS policies for the class of traffic specified in the
given class-map. A traffic class is a set of traffic that is identifiable by its packet content. For example,
Command Description
match access-list Matches, by name or number, access list traffic within a class map.
match any Identifies traffic that matches any of the criteria in the class map.
match dscp Matches the IETF-defined DSCP value (in an IP header) in a class map. You
can specify up to 64 different dscp values, defining the class as composed of
packets that match any of the specified values.
match flow ip
destination-address Enables flow-based policy actions. The criteria to define flow is the
destination IP address. All traffic going to a unique IP destination address is
considered a flow. Policy action is applied to each flow instead of the entire
class of traffic. This command always accompanies
match tunnel group .
For remote-access VPNs, this command applies to each remote-access host
flow. For LAN-to-LAN VPNs, this command applies to the single
aggregated VPN flow identified by the local and remote tunnel address pair.
match port Specifies the TCP/UDP ports as the comparison criteria for packets received
on that interface.
match precedence Matches the precedence value represented by the TOS byte in the IP header.
You can specify up to 8 different precedence values, defining the class as
composed of packets that match any of the specified values.
match rtp Matches traffic that uses a specific RTP port within a specified range. The
allowed range is targeted at capturing applications likely to be using RTP.
The packet matches the defined class only if the UDP port falls within the
specified range, inclusive, and the port number is an even number.
match tunnel group Matches every tunnel within the specified tunnel group.