Defining A Qos Policy Map - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 24 Applying QoS Policies
hostname(config)# access-list host-over-l2l extended permit ip any host 192.168.10.10
hostname(config)# class-map host-specific
hostname(config-cmap)# match access-list host-over-l2l
The following table summarizes the match command criteria available and relevant to QoS. For the full
list of all match commands and their syntax, see Cisco Security Appliance Command Reference:
Command
match access-list
match any
match dscp
match flow ip
destination-address
match port
match precedence
match rtp
match tunnel group
In addition to the user-defined classes, a system-defined class named class-default also exists. This
class-default represents all packets that do not match any of the user-defined classes, so that policies can
be defined for these packets.

Defining a QoS Policy Map

The policy-map command configures various policies, such as security policies or QoS policies. A
policy is an association of a traffic class, specified by a class command, and one or more actions. This
section specifically deals with using the policy-map command to define the QoS policies for one or more
classes of packets.
When you enter a policy-map command you enter the policy-map configuration mode, and the prompt
changes to indicate this. In this mode, you can enter class and description commands. A policy-map
command can specify multiple policies. The maximum number of policy maps is 64.
After entering the policy-map command, you then enter a class command to specify the classification
of the packet traffic. The class command configures QoS policies for the class of traffic specified in the
given class-map. A traffic class is a set of traffic that is identifiable by its packet content. For example,
OL-10088-01
Description
Matches, by name or number, access list traffic within a class map.
Identifies traffic that matches any of the criteria in the class map.
Matches the IETF-defined DSCP value (in an IP header) in a class map. You
can specify up to 64 different dscp values, defining the class as composed of
packets that match any of the specified values.
Enables flow-based policy actions. The criteria to define flow is the
destination IP address. All traffic going to a unique IP destination address is
considered a flow. Policy action is applied to each flow instead of the entire
class of traffic. This command always accompanies match tunnel group.
For remote-access VPNs, this command applies to each remote-access host
flow. For LAN-to-LAN VPNs, this command applies to the single
aggregated VPN flow identified by the local and remote tunnel address pair.
Specifies the TCP/UDP ports as the comparison criteria for packets received
on that interface.
Matches the precedence value represented by the TOS byte in the IP header.
You can specify up to 8 different precedence values, defining the class as
composed of packets that match any of the specified values.
Matches traffic that uses a specific RTP port within a specified range. The
allowed range is targeted at capturing applications likely to be using RTP.
The packet matches the defined class only if the UDP port falls within the
specified range, inclusive, and the port number is an even number.
Matches every tunnel within the specified tunnel group.
Cisco Security Appliance Command Line Configuration Guide
Defining a QoS Policy Map
24-5