Examples: Configuring Acl Classification - Cisco Nexus 9000 Series Configuration Manual

Configuring Classification
DETAILED STEPS
Command or Action
Step 1 configure terminal
Example:
switch# configure terminal
switch(config)#
Step 2
class-map [type qos] [match-any | match-all] class-name
Example:
switch(config)# class-map class_acl
Step 3
match access-group name acl-name
Example:
switch(config-cmap-qos)# match
access-group name my_acl

Examples: Configuring ACL Classification

To prevent packets from being matched by the QoS class-map, you must explicitly specify the packets you
want to match with permit statements. The implicit default deny statement at the end of the ACL will filter
out the remainder. Any explicit deny statements configured inside the access list of a QoS class map will be
ignored in the matching and treated as an explicit permit statement as shown in the examples below.
The following examples, A1, B1, and C1, all produce the same QoS matching results:
• A1
• B1
• C1
Adding an explicit DENY ALL at the end of a QoS matching ACL causes the QoS ACL to permit all traffic.
The following examples, D1 and E1, produce the same QoS matching results:
ip access-list extended A1
permit ip 10.1.0.0 0.0.255.255 any
permit ip 172.16.128.0 0.0.1.255 any
permit ip 192.168.17.0 0.0.0.255 any
ip access-list extended B1
permit ip 10.1.0.0 0.0.255.255 any
deny ip 172.16.128.0 0.0.1.255 any
permit ip 192.168.17.0 0.0.0.255 any
ip access-list extended C1
deny ip 10.1.0.0 0.0.255.255 any
deny ip 172.16.128.0 0.0.1.255 any
deny ip 192.168.17.0 0.0.0.255 any
Cisco Nexus 9000 Series NX-OS Quality of Service Configuration Guide, Release 7.x
Examples: Configuring ACL Classification
Purpose
Enters global configuration mode.
Creates or accesses the class map named class-name and
enters class-map mode. The class map name can contain
alphabetic, hyphen, or underscore characters, and can be
up to 40 characters. (match-any is the default when no
option is selected and multiple match statements are
entered.)
Configures the traffic class by matching packets based on
the acl-name. The permit and deny ACL keywords are
ignored in the matching.
/* deny is interpreted as a permit */
/* deny is interpreted as a permit */
/* deny is interpreted as a permit */
/* deny is interpreted as a permit */
59