To classify Layer 3 packets as Layer 2 packets, use the macpacket-classify command in interface configuration mode. To return to the default settings, use the no form of this command.

Syntax Description

Command Default

Layer 3 packets are not classified as Layer 2 packets.

Command Modes

Interface configuration (config-if)

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

You can configure these interface types for multilayer MAC access control list (ACL) quality of service (QoS) filtering:

• VLAN interfaces without Layer 3 addresses
• Physical LAN ports that are configured to support Ethernet over Multiprotocol Label Switching (EoMPLS)
• Logical LAN subinterfaces that are configured to support EoMPLS

The ingress traffic that is permitted or denied by a MAC ACL on an interface configured for multilayer MAC ACL QoS filtering is processed by egress interfaces as MAC-layer traffic. You cannot apply egress IP ACLs to traffic that was permitted or denied by a MAC ACL on an interface configured for multilayer MAC ACL QoS filtering.

Microflow policing does not work on interfaces that have the macpacket-classify command enabled.

The macpacket-classify command causes the Layer 3 packets to be classified as Layer 2 packets and disables IP classification.

Traffic is classified based on 802.1Q class of service (CoS), trunk VLAN, EtherType, and MAC addresses.

Related Commands

To enable VLAN-based quality of service (QoS) filtering in the MAC access control lists (ACLs), use the macpacket-classifyusevlan command in global configuration mode. To return to the default settings, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

VLAN-based QoS filtering in the MAC ACLs is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

This command is supported in PFC3BXL or PFC3B mode only.

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

You must use the nomacpacket-classifyusevlan command to disable the VLAN field in the Layer 2 key if you want to apply QoS to the Layer 2 Service Advertising Protocol (SAP)-encoded packets (for example, Intermediate System-to-Intermediate System [IS-IS] and Internet Packet Exchange [IPX]).

QoS does not allow policing of non-Advanced Research Protocol Agency (ARPA) Layer 2 packets (for example, IS-IS and IPX) if the VLAN field is enabled.

Related Commands

T o classify either all the IPv4 packets, or the IPv4 packets based on either differentiated service code point (DSCP) values or precedence values into high priority or low priority for POS, channelized, and clear-channel SPAs, use the following forms of the mapip command in ingress class-map mode. Use the no forms of this command listed here to remove the IPv4 settings.

Syntax Description

Command Default

If there is no configuration of IPv4 DSCP value or precedence values map to high priority specified, the system treats packets with DSCP range EF as high priority and precedence range 6-7 as high priority.

Command Modes

Ingress-class-map configuration mode

Command History

Usage Guidelines

To classify all IPv4 packets as high or low for POS, channelized, or clear-channel SPA, use the mapipallqueuecommand,

To classify IPv4 packets with specific DSCP values, enable the DSCP classification using the mapipdscp-basedcommand. To classify IPV4 packets with specific DSCP values as high or low, use the mapipdscp {{dscp-value | dscp-range} queue {strict-priority | 0}} command.

To classify IPv4 packets with specific precedence values, enable the precedence classification using the mapipprecedence-basedcommand. To classify IPv4 packets with specific precedence values as high or low, use the mapipprecedence {{precedence-value | precedence-range} queue {strict-priority | 0}} command.

Related Commands

T o classify either all the IPv6 packets, or IPv6 packets based on specific traffic class (TC) values as high priority or low priority in the context of POS, channelized, and clear-channel SPAs use the following forms of mapipv6 commands in ingress class-map mode. Use the no forms of this command listed here to remove the IPv6 settings.

Syntax Description

Command Default

If a user does not configure which IPv6 traffic class values map to high priority, the system treats packets the packets with traffic class EF as high priority.

Command Modes

Ingress-class-map configuration mode

Command History

Usage Guidelines

To classify all the IPv6 packets as high priority or low priority in the context of POS, channelized, or clear-channel SPAs, use the mapipv6allqueuecommand.

To classify the IPv6 packets with specific traffic class values, use the mapipv6tccs2queuestrict-prioritycommand.

Related Commands

T o classify either all the Multiprotocol Label Switching (MPLS) packets or MPLS packets with specified EXP values or range as high priority or low priority for POS, channelized, and clear-channel SPAs the following forms of the mapmpls command are used in ingress class-map mode. Use the no forms of this command listed here to remove the MPLS settings.

Syntax Description

Command Default

If a user does not configure which MPLS EXP values map to high priority, the system treats packets with an EXP value of 6-7 as high priority.

Command Modes

Ingress-class-map configuration mode

Command History

Usage Guidelines

To classify all the MPLS packets as high priority or low priority for POS, channelized, or clear-channel SPA, use the mapmplsallqueuecommand.

To classify the MPLS packets with specific EXP values, use the mapmplsexp{exp-value|exp-range}queue{strict-priority|0} command.

Related Commands

To configure the match criteria for a class map on the basis of the specified access control list (ACL), use the match access-group command in QoS class-map configuration or policy inline configuration mode. To remove the ACL match criteria from a class map, use the no form of this command.

Syntax Description

Command Default

No match criteria are configured.

Command Modes

QoS class-map configuration (config-cmap)

Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

The match access-group command specifies a numbered or named ACL whose contents are used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.

A traffic rate is generated for packets that match an access group. In zone-based policy firewalls, only the first packet that creates a session matches the configured policy. Subsequent packets in the flow do not match the filters in the configured policy, but instead match the session directly. The statistics related to subsequent packets are shown as part of the inspect action.

Zone-based policy firewalls support only the match access-group, match class-map, and match protocol commands. If you specify more than one match command in a class map, only the last command that you specified will be applied to the class map. The last match command overrides the previously entered match commands.

The match access-group command specifies the numbered access list against whose contents packets are checked to determine if they match the criteria specified in the class map. Access lists configured with the log keyword of the access-list command are not supported when you configure the match criteria. For more information about the access-list command, refer to the Cisco IOS IP Application Services Command Reference.

When this command is configured in Cisco IOS Release 15.0(1)M and later releases, the firewall inspects only Layer 4 policy maps. In releases prior to Cisco IOS Release 15.0(1)M, the firewall inspects both Layer 4 and Layer 7 policy maps.

For class-based weighted fair queueing (CBWFQ), you can define traffic classes based on the match criteria that include ACLs, experimental (EXP) field values, input interfaces, protocols, and quality of service (QoS) labels. Packets that satisfy the match criteria for a class constitute the traffic for that class.

Note	In zone-based policy firewalls, this command is not applicable for CBWFQ.

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration modes in which you can issue this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

To use the match access-group command, you must configure the service-policy type performance-monitor inline command.

Supported Platforms Other than Cisco 10000 Series Routers

To use the match access-group command, you must configure the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:

• match access-group
• match input-interface
• match mpls experimental
• match protocol

Cisco 10000 Series Routers

To use the match access-group command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.

Note

The match access-group command specifies the numbered access list against whose contents packets are checked to determine if they match the criteria specified in the class map. Access lists configured with the log keyword of the access-list command are not supported when you configure the match criteria.

Cisco ASR 1000 Series Aggregation Services Routers

Cisco ASR 1000 Series Routers do not support more than 16 match statements per class map. An interface with more than 16 match statements rejects the service policy.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

The following example shows how to configure a service policy for the Performance Monitor in policy inline configuration mode. The policy specifies that packets traversing Ethernet interface 0/0 must match ACL144.

Device(config)# interface ethernet 0/0 
Device(config-if)# service-policy type performance-monitor inline input
Device(config-if-spolicy-inline)# match access-group name ACL144 
Device(config-if-spolicy-inline)# exit

Related Commands

To use the metadata application as a match criterion for control plane classification, use the match application command in QoS class-map configuration mode. To remove a previously configured metadata application from being used as a match criterion for control plane classification, use the no form of this command.

Syntax Description

Command Default

Metadata-based control plane classification is disabled.

Command Modes

QoS class-map configuration (config-cmap)

Command History

Usage Guidelines

Enabling metadata-based control plane classification on a per-platform, per-line card basis for quality of service (QoS) policies involves the following key steps:

• Creating a class map with metadata-based filters.
• Creating a policy map that uses classes.
• Attaching a policy map to the target.

You can use the match application command to enable metadata-based filters that can be applied to a class map. Specifying the required application name ensures that the respective policies can be applied only to those flows that match the application name.

You can use the match application command in conjunction with any other match commands for specifying match criteria for classes. For example, you can use the match dscp command along with the match application command as the classification criteria for flows.

You can use the show metadata flow classification table command to verify the metadata-based classification information.

You can use the debug metadata flow all command to verify whether a particular classification has been successfully created.

Note	With CSCub24690, the webex-data, webex-streaming, webex-video, and webex-voice keywords are not supported in the match application application-name command.

Related Commands

To configure the match criteria for a class map to be successful match criteria for all packets, use the matchany command in class-map configuration or policy inline configuration mode. To remove all criteria as successful match criteria, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

No match criteria are specified.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To enable packet matching on the basis of the ATM cell loss priority (CLP), use the matchatm-clpcommand in class-map configuration mode. To disable packet matching on the basis of the ATM CLP, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Packets are not matched on the basis of the ATM CLP.

Command Modes

Class-map configuration (config-cmap)

Command History

Usage Guidelines

This command is supported on policy maps that are attached to ATM main interfaces, ATM subinterfaces, or ATM permanent virtual circuits (PVCs). However, policy maps (containing the matchatm-clp command) that are attached to these types of ATM interfaces can be input policy maps only .

This command is supported on the PA-A3 adapter only .

Related Commands

To enable the control traffic classification on an ATM interface, use the matchatmoamcommand in class-map configuration mode. To disable the control traffic classification, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

No default behavior or values

Command Modes

Class-map configuration

Command History

Usage Guidelines

Use this command for policy maps attached to ATM interfaces or ATM permanent virtual circuits (PVCs). Policy maps containing the matchatmoam command attached to ATM interfaces or ATM PVCs can be input policy maps only.

Related Commands

To enable packet matching on the basis of the ATM virtual circuit interface (VCI), use the matchatm-vcicommand in class map configuration mode. To disable packet matching on the basis of the ATM VCI, use thenoform of this command.

Syntax Description

Command Default

No match criteria are configured.

Command Modes

Class map configuration (config-cmap)

Command History

Usage Guidelines

When you configure the matchatm-vcicommand in class map configuration mode, you can add this class map to a policy map that can be attached only to an ATM permanent virtual path (PVP).

Note	On the Cisco 7600 series router, the matchatm-vcicommand is supported only in the ingress direction on an ATM VP.

You can use the matchnot command to match any VC except those you specify in the command.

Related Commands

To use a traffic class as a classification policy, use the match class-map command in class-map or policy inline configuration mode. To remove a specific traffic class as a match criterion, use the no form of this command.

Syntax Description

Command Default

No match criteria are specified.

Command Modes

Class-map configuration (config-cmap)

Command History

Usage Guidelines

The only method of including both match-any and match-all characteristics in a single traffic class is to use the match class-map command. To combine match-any and match-all characteristics into a single class, do one of the following:

• Create a traffic class with the match-anyinstruction and use a class configured with the match-all instruction as a match criterion (using the match class-map command).
• Create a traffic class with the match-allinstruction and use a class configured with the match-any instruction as a match criterion (using the match class-map command).

You can also use the match class-map command to nest traffic classes within one another, saving users the overhead of re-creating a new traffic class when most of the information exists in a previously configured traffic class.

When packets are matched to a class map, a traffic rate is generated for these packets. In a zone-based firewall policy, only the first packet that creates a session matches the policy. Subsequent packets in this flow do not match the filters in the configured policy, but instead match the session directly. The statistics related to subsequent packets are shown as part of the 'inspect' action.

Related Commands

To match a packet on the basis of a Layer 2 class of service (CoS)/Inter-Switch Link (ISL) marking, use the matchcos command in class-map configuration or policy inline configuration mode. To remove a specific Layer 2 CoS/ISL marking as a match criterion, use the no form of this command.

Syntax Description

Command Default

Packets are not matched on the basis of a Layer 2 CoS/ISL marking.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To match the inner cos of QinQ packets on a Layer 2 class of service (CoS) marking, use the matchcosinnercommand in class-map configuration mode. To remove a specific Layer 2 CoS inner tag marking, use the no form of this command.

Syntax Description

Command Default

No match criteria are specified.

Command Modes

Class-map configuration

Command History

Related Commands

To use the destination MAC address as a match criterion, use the matchdestination-addressmaccommand in class-map configuration or policy inline configuration mode. To remove a previously specified destination MAC address as a match criterion, use the noform of this command.

Syntax Description

Command Default

No destination MAC address is specified.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To specify a discard class as a match criterion, use the matchdiscard-class command in class-map configuration or policy inline configuration mode. To remove a previously specified discard class as a match criterion, use the no form of this command.

Syntax Description

Command Default

Packets will not be classified as expected.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

A discard-class value has no mathematical significance. For example, the discard-class value 2 is not greater than 1. The value simply indicates that a packet marked with discard-class 2 should be treated differently than a packet marked with discard-class 1.

Packets that match the specified discard-class value are treated differently from packets marked with other discard-class values. The discard-class is a matching criterion only, used in defining per hop behavior (PHB) for dropping traffic.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To identify one or more differentiated service code point (DSCP), Assured Forwarding (AF), and Certificate Server (CS) values as a match criterion, use the match dscp command in class-map configuration or policy inline configuration mode. To remove a specific DSCP value from a class map, use the no form of this command.

Syntax Description

Command Default

No match criteria are configured.

Command Modes

class-map configuration (config-cmap)
policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policy type performance-monitor inline command.

DSCP Values

You must enter one or more differentiated service code point (DSCP) values. The command may include any combination of the following:

• Numbers (0 to 63) representing differentiated services code point values
• AF numbers (for example, af11) identifying specific AF DSCPs
• CS numbers (for example, cs1) identifying specific CS DSCPs
• default--Matches packets with the default DSCP.
• ef--Matches packets with EF DSCP.

For example, if you wanted the DCSP values of 0, 1, 2, 3, 4, 5, 6, or 7 (note that only one of the IP DSCP values must be a successful match criterion, not all of the specified DSCP values), enter the match dscp 01234567 command.

This command is used by the class map to identify a specific DSCP value marking on a packet. In this context, dscp-value arguments are used as markings only and have no mathematical significance. For instance, the dscp-value of 2 is not greater than 1. The value simply indicates that a packet marked with the dscp-value of 2 is different than a packet marked with the dscp-value of 1. The treatment of these marked packets is defined by the user through the setting of Quality of Service (QoS) policies in policy-map class configuration mode.

Match Packets on DSCP Values

To match DSCP values for IPv6 packets only, the match protocol ipv6 command must also be used. Without that command, the DSCP match defaults to match both IPv4 and IPv6 packets.

To match DSCP values for IPv4 packets only, use the ip keyword. Without the ip keyword the match occurs on both IPv4 and IPv6 packets. Alternatively, the match protocol ip command may be used with match dscp to classify only IPv4 packets.

After the DSCP bit is set, other QoS features can then operate on the bit settings.

The network can give priority (or some type of expedited handling) to marked traffic. Typically, you set the precedence value at the edge of the network (or administrative domain); data is then queued according to the precedence. Weighted fair queueing (WFQ) can speed up handling for high-precedence traffic at congestion points. Weighted Random Early Detection (WRED) can ensure that high-precedence traffic has lower loss rates than other traffic during times of congestion.

Cisco 10000 Series Routers

The Cisco 10000 series routers support DSCP matching of IPv4 packets only. You must include the ip keyword when specifying the DSCP values to use as match criterion.

You cannot use the set ip dscp command with the set ip precedence command to mark the same packet. DSCP and precedence values are mutually exclusive. A packet can have one value or the other, but not both.

Related Commands

Note	Effective with Cisco IOS Release 15.2(4)M, the match field command is not available in Cisco IOS software.

To configure the match criteria for a class map on the basis of the fields defined in the protocol header description files (PHDFs), use the match field command in class-map configuration mode. To remove the specified match criteria, use the no form of this command.

Syntax Description

Command Default

No match criteria are configured.

Command Modes

Class-map configuration

Command History

Usage Guidelines

Before issuing the match-field command, you must load a PHDF onto the router via the load protocol command. Thereafter, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.

Match criteria are defined via a start point, offset, size, value to match, and mask. A match can be defined on a pattern with any protocol field.

Related Commands

To specify a Packet Data Protocol (PDP) flow as a match criterion in a class map, use the matchflowpdp command in class-map configuration mode. To remove a PDP flow as a match criterion, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

A PDP flow is not specified as a match criterion.

Command Modes

Class-map configuration (config-cmap)

Command History

Usage Guidelines

The matchflowpdp command allows you to match and classify traffic on the basis of a PDP flow.

The matchflowpdp command is included with the Flow-Based QoS for GGSN feature available with Cisco IOS Release 12.4(9)T. The Flow-Based QoS for GGSN feature is designed specifically for the Gateway General Packet Radio Service (GPRS) Support Node (GGSN).

Per-PDP Policing

The Flow-Based QoS for GGSN feature includes per-PDP policing (session-based policing).

The matchflowpdp command (when used in conjunction with the class-map command, the policy-map command, the policeratepdp command, and the service-policy command) allows you to configure per-PDP policing (session-based policing) for downlink traffic on a GGSN.

Note the following points related to per-PDP policing:

• When using the class-map command to define a class map for PDP flow classification, do not use the match-anykeyword.
• Per-PDP policing functionality requires that you configure Universal Mobile Telecommunications System (UMTS) quality of service (QoS). For information on configuring UMTS QoS, see the "Configuring QoS on the GGSN" section of the Cisco GGSN Release 6.0 Configuration Guide , Cisco IOS Release 12.4(2)XB.
• The policy map created to configure per-PDP policing cannot contain multiple classes within which only the matchflowpdp command has been specified. In other words, if there are multiple classes in the policy map, the matchflowpdpcommand must be used in conjunction with another match statement (for example, matchprecedence) in at least one class.

For More Information

For more information about the GGSN, along with the instructions for configuring the Flow-Based QoS for GGSN feature, see the Cisco GGSN Release 6.0 Configuration Guide , Cisco IOS Release 12.4(2)XB.

Note	To configure the Flow-Based QoS for GGSN feature, follow the instructions in the section called " Configuring Per-PDP Policing ."

For more information about the GGSN-specific commands, see the Cisco GGSN Release 6.0 Command Reference , Cisco IOS Release 12.4(2)XB.

Related Commands

To specify the Frame Relay data-link connection identifier (DLCI) number as a match criterion in a class map, use the matchfr-dlcicommand in class-map configuration or policy inline configuration mode. To remove a previously specified DLCI number as a match criterion, use the no form of this command.

Syntax Description

Command Default

No DLCI number is specified.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

This match criterion can be used in main interfaces and point-to-multipoint subinterfaces in Frame Relay networks, and it can also be used in hierarchical policy maps.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To configure a class map to match incoming packets that have a specific virtual local area network (VLAN) ID, use the matchinputvlancommand in class map configuration mode. To remove the matching of VLAN IDs, use the no form of this command.

Syntax Description

Command Default

By default, no matching is done on VLAN IDs.

Command Modes

Class map configuration

Command History

Usage Guidelines

The matchinputvlan command allows you to create a class map that matches packets with one or more specific VLAN IDs, as they were received on the input (ingress) interface. This enables hierarchical Quality of Service (HQoS) for Ethernet over MPLS (EoMPLS) Virtual Circuits (VC), allowing parent and child relationships between QoS class maps and policy maps. This in turn enables service providers to easily classify and shape traffic for a particular EoMPLS network.

In EoMPLS applications, the parent class map typically specifies the maximum bandwidth for all of the VCs in a specific EoMPLS network. Then the child class maps perform other QoS operations, such as traffic shaping, on a subset of this traffic.

Do not confuse the matchinputvlan command with the matchvlan command, which is also a class-map configuration command.

• The matchvlan command matches the VLAN ID on packets for the particular interface at which the policy map is applied. Policy maps using the matchvlan command can be applied to either ingress or egress interfaces on the router, using the service-policy {input | output} command.
• The matchinputvlan command matches the VLAN ID that was on packets when they were received on the ingress interface on the router. Typically, policy maps using the matchinputvlan command are applied to egress interfaces on the router, using the service-policyoutput command.

The matchinputvlan command can also be confused with the matchinput-interfacevlan command, which matches packets being received on a logical VLAN interface that is used for inter-VLAN routing.

Tip	Because class maps also support the matchinput-interface command, you cannot abbreviate the input keyword when giving the matchinputvlan command.

Note	The matchinputvlan command cannot be used only on Layer 2 LAN ports on FlexWAN, Enhanced FlexWAN, and Optical Service Modules (OSM) line cards.

The following restrictions apply when using the matchinputvlan command:

• You cannot attach a policy with matchinputvlan to an interface if you have already attached a service policy to a VLAN interface (a logical interface that has been created with the interfacevlan command).
• Class maps that use the matchinputvlan command support only the match-any option. You cannot use the match-all option in class maps that use the matchinputvlan command.
• If the parent class contains a class map with a matchinputvlan command, you cannot use a matchexp command in a child class map.

Related Commands

To configure a class map to use the specified input interface as a match criterion, use the match input-interface command in class-map configuration or policy inline configuration mode. To remove the input interface match criterion from a class map, use the no form of this command.

Syntax Description

Command Default

No match criteria are specified.

Command Modes

Class-map configuration (config-cmap)

Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

Note	With CSCtx62310, the minimum string you must enter to uniquely identify this command is match input-. The device no longer accepts match input as an abbreviated version of this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

To enter policy inline configuration mode, you must first enter the service-policy type performance-monitor inline command.

Supported Platforms Other Than Cisco 10000 Series Routers

For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria including input interfaces, access control lists (ACLs), protocols, quality of service (QoS) labels, and experimental (EXP) field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The match input-interface command specifies the name of an input interface to be used as the match criterion against which packets are checked to determine if they belong to the class specified by the class map.

To use the match input-interface command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:

• match access-group
• match input-interface
• match mpls experimental
• match protocol

If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.

Cisco 10000 Series Routers

For CBWFQ, you define traffic classes based on match criteria including input interfaces, ACLs, protocols, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

To use the match input-interface command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.

Related Commands

The matchipdscpcommand is replaced by the match dscpcommand. See the match dscpcommand for more information.

The matchipprecedencecommand is replaced by the match precedencecommand. See the match precedencecommand for more information.

To configure a class map to use the Real-Time Protocol (RTP) port as the match criterion, use the matchiprtpcommand in class-map configuration or policy inline configuration mode. To remove the RTP port match criterion, use the no form of this command.

Syntax Description

Command Default

No match criteria are specified.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

This command is used to match IP RTP packets that fall within the specified port range. It matches packets destined to all even User Datagram Port (UDP) port numbers in the range from the starting port number argument to the starting port number plus the port range argument.

Use of an RTP port range as the match criterion is particularly effective for applications that use RTP, such as voice or video.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To configure a class map to use the specified value or values of the experimental (EXP) field as a match criteria, use the matchmplsexperimentalcommand in class-map configuration mode. To remove the EXP field match criteria from a class map, use the no form of this command.

Syntax Description

Command Default

No match criteria are specified.

Command Modes

Class-map configuration

Command History

Usage Guidelines

Supported Platforms Other Than the Cisco 10000 Series

For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria such as input interfaces, access control lists (ACLs), protocols, quality of service (QoS) labels, and experimental (EXP) field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The matchmplsexperimental command specifies the name of an EXP field value to be used as the match criterion against which packets are compared to determine if they belong to the class specified by the class map.

To use the matchmplsexperimental command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:

• match access-group
• match input-interface
• match mpls experimental
• match protocol

If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.

Cisco 10000 Series

This command is available only on the ESR-PRE1 module.

For CBWFQ, you define traffic classes based on match criteria such as input interfaces, ACLs, protocols, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

To use the matchmplsexperimental command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.

Related Commands

To match the experimental (EXP) value in the topmost label header, use the matchmplsexperimentaltopmostcommand in class-map configuration or policy inline configuration mode. To remove the EXP match criterion, use the no form of this command.

Syntax Description

Command Default

No EXP match criterion is configured for the topmost label header.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

You can enter this command on the input interfaces and the output interfaces. It will match only on MPLS packets.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To specify the single match criterion value to use as an unsuccessful match criterion, use the matchnotcommand inclass-map configuration or policy inline configuration mode. To remove a previously specified source value to not use as a match criterion, use the noform of this command.

Syntax Description

Command Default

No unsuccessful match criterion is configured.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

The matchnotcommand is used to specify a quality of service (QoS) policy value that is not used as a match criterion. When thematchnot command is used, all other values of that QoS policy become successful match criteria.

For instance, if the matchnotqos-group4 command is issued in QoS class-map configuration mode, the specified class will accept all QoS group values except 4 as successful match criteria.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To specify the Layer 3 packet length in the IP header as a match criterion in a class map, use the matchpacketlength command in class-map configuration or policy inline configuration mode. To remove a previously specified Layer 3 packet length as a match criterion, use the no form of this command.

Syntax Description

Command Default

The Layer 3 packet length in the IP header is not used as a match criterion.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

This command considers only the Layer 3 packet length in the IP header. It does not consider the Layer 2 packet length in the IP header.

When using this command, you must at least specify the maximum or minimum value. However, you do have the option of entering both values.

If only the minimum value is specified, a packet with a Layer 3 length greater than the minimum is viewed as matching the criterion.

If only the maximum value is specified, a packet with a Layer 3 length less than the maximum is viewed as matching the criterion.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Related Commands

To match the access policy on the basis of the port for a class map, use the matchport-type command in class-map configuration mode. To delete the port type, use the no form of this command.

Syntax Description

Command Default

Access policy is not matched.

Command Modes

Class-map configuration

Command History

Usage Guidelines

This command is used because, on the basis of the port on which a user is connecting, the access policies that are applied to it can be different.

Related Commands

To identify IP precedence values to use as the match criterion, use the matchprecedence command in class-map configuration or policy inline configuration mode. To remove IP precedence values from a class map, use the no form of this command.

Syntax Description

Command Default

No match criterion is configured.

Command Modes

class-map configuration (config-cmap)
policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

You can enter up to four matching criteria, a number abbreviation (0 to 7) or criteria names (critical, flash, and so on), in a single match statement. For example, if you wanted the precedence values of 0, 1, 2, or 3 (note that only one of the precedence values must be a successful match criterion, not all of the specified precedence values), enter the matchipprecedence0123command. The precedence-criteria numbers are not mathematically significant; that is, the precedence-criteria of 2 is not greater than 1. The way that these different packets are treated depends upon quality of service (QoS) policies, set in policy-map configuration mode.

You can configure a QoS policy to include IP precedence marking for packets entering the network. Devices within your network can then use the newly marked IP precedence values to determine how to treat the packets. For example, class-based weighted random early detection (WRED) uses IP precedence values to determine the probability that a packet is dropped. You can also mark voice packets with a particular precedence. You can then configure low-latency queueing (LLQ) to place all packets of that precedence into the priority queue.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinline command.

Matching Precedence for IPv6 and IPv4 Packets on the Cisco 7600 and 10000 and Series Routers

On the Cisco 7600 series and 10000 series routers, you set matching criteria based on precedence values for only IPv6 packets using the matchprotocolcommand with the ipv6 keyword. Without that keyword, the precedence match defaults to match both IPv4 and IPv6 packets. You set matching criteria based on precedence values for IPv4 packets only using the ip keyword. Without the ip keyword the match occurs on both IPv4 and IPv6 packets.

Precedence Values and Names

The following table lists all criteria conditions by value, name, binary value, and recommended use. You may enter up to four criteria, each separated by a space. Only one of the precedence values must be a successful match criterion. The table below lists the IP precedence values.

Do not use IP precedence 6 or 7 to mark packets, unless you are marking control packets.

Related Commands

To configure the match criterion for a class map on the basis of a specified protocol, use the matchprotocol command in class-map configuration or policy inline configuration mode. To remove the protocol-based match criterion from the class map, use the no form of this command.

Syntax Description

Command Default

No match criterion is configured.

Command Modes

Class-map configuration (config-cmap)
Policy inline configuration (config-if-spolicy-inline)

Command History

Usage Guidelines

This command can be used with both Flexible NetFlow and Performance Monitor. These products use different commands to enter the configuration mode in which you issue this command.

Cisco Performance Monitor in Cisco IOS Release 15.1(3)T and 12.2(58)SE

You must first enter the service-policytypeperformance-monitorinlinecommand.

Supported Platforms Other Than Cisco 7600 Routers and Cisco 10000 Series Routers

For class-based weighted fair queueing (CBWFQ), you define traffic classes based on match criteria protocols, access control lists (ACLs), input interfaces, quality of service (QoS) labels, and Experimental (EXP) field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The matchprotocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.

The matchprotocolipx command matches packets in the output direction only.

To use the matchprotocol command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish. After you identify the class, you can use one of the following commands to configure its match criteria:

• match access-group
• match input-interface
• match mpls experimental

If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.

To configure NBAR to match protocol types that are supported by NBAR traffic, use the matchprotocol(NBAR)command.

Cisco 7600 Series Routers

The matchprotocol command in QoS class-map configuration configures NBAR and sends all traffic on the port, both ingress and egress, to be processed in the software on the Multilayer Switch Feature Card 2 (MSFC2).

For CBWFQ, you define traffic classes based on match criteria like protocols, ACLs, input interfaces, QoS labels, and Multiprotocol Label Switching (MPLS) EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The matchprotocolcommand specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.

If you want to use the matchprotocolcommand, you must first enter the class-map command to specify the name of the class to which you want to establish the match criteria.

If you specify more than one command in a class map, only the last command entered applies. The last command overrides the previously entered commands.

This command can be used to match protocols that are known to the NBAR feature. For a list of protocols supported by NBAR, see the "Classification" part of the Cisco IOS Quality of Service Solutions Configuration Guide.

Cisco 10000 Series Routers

For CBWFQ, you define traffic classes based on match criteria including protocols, ACLs, input interfaces, QoS labels, and EXP field values. Packets satisfying the match criteria for a class constitute the traffic for that class.

The matchprotocol command specifies the name of a protocol to be used as the match criteria against which packets are checked to determine if they belong to the class specified by the class map.

The matchprotocolipx command matches packets in the output direction only.

To use the matchprotocol command, you must first enter the class-map command to specify the name of the class whose match criteria you want to establish.

If you are matching NBAR protocols, use the matchprotocol(NBAR) command.

Match Protocol Command Restrictions (Catalyst 6500 Series Switches Only)

Policy maps contain traffic classes. Traffic classes contain one or more match commands that can be used to match packets (and organize them into groups) on the basis of a protocol type or application. You can create as many traffic classes as needed.

Cisco IOS Release 12.2(18)ZY includes software intended for use on the Catalyst 6500 series switch that is equipped with a Supervisor 32/PISA engine. For this release and platform, note the following restrictions for using policy maps and matchprotocol commands:

• A single traffic class can be configured to match a maximum of 8 protocols or applications.
• Multiple traffic classes can be configured to match a cumulative maximum of 95 protocols or applications.

Supported Protocols

The table below lists the protocols supported by most routers. Some routers support a few additional protocols. For example, the Cisco 7600 router supports the AARP and DECnet protocols, while the Cisco 7200 router supports the directconnect and PPPOE protocols. For a complete list of supported protocols, see the online help for the matchprotocol command on the router that you are using.