HP ProCurve Secure Router 7203 dl Advanced Management And Configuration Manual page 335

less that interface can grant higher priority subqueues significantly greater
bandwidth. Dividing traffic into a small number of classes alleviates this
problem.
You classify traffic in this way by matching the QoS map entry to an extended
access control list (ACL). The ACL actually selects the traffic. An extended
ACL can define traffic according to its source and destination IP address, as
well as a variety of fields in the IP, TCP, or UDP headers.
To classify traffic:
1. Configure an ACL.
a. Create an extended ACL—QoS maps can only use extended ACLs.
b. Add any necessary deny entries to the ACL.
c. Add permit entries for the source and/or destination addresses of
traffic in the class.
2. Match the QoS map entry to the ACL.
Configuring an ACL. Create an ACL by entering this command from the
global configuration mode context:
Syntax: ip access-list extended <listname>
For example:
ProCurve(config)# ip access-list extended ClassSelector
ACLs exclude all traffic that you do not explicitly permit, so you may not need
to enter any deny statements. However, you will often permit an entire range
of addresses. If you want to deny a host or hosts within this range, you must
explicitly deny those hosts. You must enter the deny statements first because
the router processes ACL entries in order and stops processing them as soon
as it finds a match.
You use this command to select traffic in the ACL:
Syntax: [deny | permit] ip [any | host <source A.B.C.D> | <source A.B.C.D> <wildcard
bits>] [any | host <destination A.B.C.D> | <destination A.B.C.D> <wildcard bits>]
Very often, you will want an ACL to select an entire range of addresses or
subnets. ACLs on the ProCurve Secure Router use wildcard bits (which
operate on reverse logic from subnet masks) to select a range of addresses.
Setting Up Quality of Service
Configuring CBWFQ
7-23