Cisco ASA 5506-X Configuration Manual page 285

Chapter 12 Quality of Service
Configuration Examples for Priority Queuing and Policing
The following sections provide examples of configuring priority queuing and policing.
Class Map Examples for VPN Traffic
In the following example, the class-map command classifies all non-tunneled TCP traffic, using an ACL
named tcp_traffic:
hostname(config)# access-list tcp_traffic permit tcp any any
hostname(config)# class-map tcp_traffic
hostname(config-cmap)# match access-list tcp_traffic
In the following example, other, more specific match criteria are used for classifying traffic for specific,
security-related tunnel groups. These specific match criteria stipulate that a match on tunnel-group (in
this case, the previously-defined Tunnel-Group-1) is required as the first match characteristic to classify
traffic for a specific tunnel, and it allows for an additional match line to classify the traffic (IP differential
services code point, expedited forwarding).
hostname(config)# class-map TG1-voice
hostname(config-cmap)# match tunnel-group tunnel-grp1
hostname(config-cmap)# match dscp ef
In the following example, the class-map command classifies both tunneled and non-tunneled traffic
according to the traffic type:
hostname(config)# access-list tunneled extended permit ip 10.10.34.0 255.255.255.0
192.168.10.0 255.255.255.0
hostname(config)# access-list non-tunneled extended permit tcp any any
hostname(config)# tunnel-group tunnel-grp1 type IPsec_L2L
hostname(config)# class-map browse
hostname(config-cmap)# description "This class-map matches all non-tunneled tcp traffic."
hostname(config-cmap)# match access-list non-tunneled
hostname(config-cmap)# class-map TG1-voice
hostname(config-cmap)# description "This class-map matches all dscp ef traffic for
tunnel-grp 1."
hostname(config-cmap)# match dscp ef
hostname(config-cmap)# match tunnel-group tunnel-grp1
hostname(config-cmap)# class-map TG1-BestEffort
hostname(config-cmap)# description "This class-map matches all best-effort traffic for
tunnel-grp1."
hostname(config-cmap)# match tunnel-group tunnel-grp1
hostname(config-cmap)# match flow ip destination-address
The following example shows a way of policing traffic within a tunnel, provided the classed traffic is not
specified as a tunnel, but does go through the tunnel. In this example, 192.168.10.10 is the address of
the host machine on the private side of the remote tunnel, and the ACL is named "host-over-l2l". By
creating a class-map (named "host-specific"), you can then police the "host-specific" class before the
LAN-to-LAN connection polices the tunnel. In this example, the "host-specific" traffic is rate-limited
before the tunnel, then the tunnel is rate-limited:
hostname(config)# access-list host-over-l2l extended permit ip any host 192.168.10.10
hostname(config)# class-map host-specific
hostname(config-cmap)# match access-list host-over-l2l
Configuration Examples for Priority Queuing and Policing
Cisco ASA Series Firewall CLI Configuration Guide
12-11