Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1362 / 2164

1-12
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring QoS
Configuring QoS
hostname(config)# class-map tcp_traffic
hostname(config-cmap)# match access-list tcp_traffic
In the following example, other, more specific match criteria are used for classifying traffic for specific,
security-related tunnel groups. These specific match criteria stipulate that a match on tunnel-group (in
this case, the previously-defined Tunnel-Group-1) is required as the first match characteristic to classify
traffic for a specific tunnel, and it allows for an additional match line to classify the traffic (IP differential
services code point, expedited forwarding).
hostname(config)# class-map TG1-voice
hostname(config-cmap)#
match tunnel-group tunnel-grp1
hostname(config-cmap)# match dscp ef
In the following example, the class-map command classifies both tunneled and non-tunneled traffic
according to the traffic type:
hostname(config)# access-list tunneled extended permit ip 10.10.34.0 255.255.255.0
192.168.10.0 255.255.255.0
hostname(config)# access-list non-tunneled extended permit tcp any any
hostname(config)# tunnel-group tunnel-grp1 type IPsec_L2L
hostname(config)# class-map browse
hostname(config-cmap)# description "This class-map matches all non-tunneled tcp traffic."
hostname(config-cmap)# match access-list non-tunneled
hostname(config-cmap)# class-map TG1-voice
hostname(config-cmap)# description "This class-map matches all dscp ef traffic for
tunnel-grp 1."
hostname(config-cmap)# match dscp ef
hostname(config-cmap)# match tunnel-group tunnel-grp1
hostname(config-cmap)# class-map TG1-BestEffort
hostname(config-cmap)# description "This class-map matches all best-effort traffic for
tunnel-grp1."
hostname(config-cmap)# match tunnel-group tunnel-grp1
hostname(config-cmap)# match flow ip destination-address
The following example shows a way of policing a flow within a tunnel, provided the classed traffic is
not specified as a tunnel, but does go
through the tunnel. In this example, 192.168.10.10 is the address
of the host machine on the private side of the remote tunnel, and the access list is named “host-over-l2l”.
By creating a class-map (named “host-specific”), you can then police the “host-specific” class before the
LAN-to-LAN connection polices the tunnel. In this example, the “host-specific” traffic is rate-limited
before the tunnel, then the tunnel is rate-limited:
hostname(config)# access-list host-over-l2l extended permit ip any host 192.168.10.10
hostname(config)# class-map host-specific
hostname(config-cmap)#
match access-list host-over-l2l
The following example builds on the configuration developed in the previous section. As in the previous
example, there are two named class-maps: tcp_traffic and TG1-voice.
hostname(config)# class-map TG1-best-effort
hostname(config-cmap)# match tunnel-group Tunnel-Group-1
hostname(config-cmap)# match flow ip destination-address
Adding a third class map provides a basis for defining a tunneled and non-tunneled QoS policy, as
follows, which creates a simple QoS policy for tunneled and non-tunneled traffic, assigning packets of
the class TG1-voice to the low latency queue and setting rate limits on the tcp_traffic and
TG1-best-effort traffic flows.