Classifying network traffic allows you to organize traffic (that is, packets) into traffic classes or categories on the basis of whether the traffic matches specific criteria. Classifying network traffic is the foundation for enabling many quality of service (QoS) features on your network. This module contains conceptual information and the configuration tasks for classifying network traffic.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Classifying Network Traffic
To mark network traffic, Cisco Express Forwarding (CEF) must be configured on both the interface receiving the traffic and the interface sending the traffic.
Classifying network traffic allows you to organize traffic (that is, packets) into traffic classes or categories on the basis of whether the traffic matches specific criteria. Classifying network traffic is the foundation for enabling other QoS features such as traffic shaping and traffic policing on your network.
The goal of network traffic classification is to group traffic based on user-defined criteria so that the resulting groups of network traffic can then be subjected to specific QoS treatments. The QoS treatments might include faster forwarding by intermediate routers and switches or reduced probability of the traffic being dropped due to lack of buffering resources.
Identifying and categorizing network traffic into traffic classes (that is, classifying packets) enables distinct handling for different types of traffic, effectively separating network traffic into different categories. This classification can be associated with a variety of match criteria such as the IP Precedence value, differentiated services code point (DSCP) value, class of service (CoS) value, source and destination MAC addresses, input interface, or protocol type. You classify network traffic by using class maps and policy maps with the Modular Quality of Service Command-Line Interface (MQC). For example, you can configure class maps and policy maps to classify network traffic on the basis of the QoS group, Frame Relay DLCI number, Layer 2 packet length, or other criteria that you specify.
Benefits of Classifying Network Traffic
Classifying network traffic allows you to see what kinds of traffic you have, organize the various kinds of network traffic into traffic classes, and treat some types of traffic differently than others. Identifying and organizing network traffic is the foundation for applying the appropriate QoS feature to that traffic, enabling you to allocate network resources to deliver optimal performance for different types of traffic. For example, high-priority network traffic or traffic matching specific criteria can be singled out for special handling, and thus, help to achieve peak application performance.
MQC and Network Traffic Classification
To configure network traffic classification, you use the Modular Quality of Service Command-Line Interface (MQC).
The MQC is a CLI structure that allows you to complete the following tasks:
Specify the matching criteria used to define a traffic class.
Create a traffic policy (policy map). The traffic policy defines the QoS policy actions to be taken for each traffic class.
Apply the policy actions specified in the policy map to an interface, subinterface, or ATM permanent virtual circuit (PVC) by using the service-policy command.
Network Traffic Classification match Commands and Match Criteria
Network traffic classification allows you to group or categorize traffic on the basis of whether the traffic meets one or more specific criteria. For example, network traffic with a specific IP precedence can be placed into one traffic class, while traffic with a specific DSCP value can be placed into another traffic class. The network traffic within that traffic class can be given the appropriate QoS treatment, which you can configure in a policy map later.
You specify the criteria used to classify traffic with a
match command. The table below lists the available
match commands and the corresponding match criterion.
Fields defined in the protocol header description files (PHDFs)
matchfr-de
Frame Relay discard eligibility (DE) bit setting
matchfr-dlci
Frame Relay data-link connection identifier (DLCI) number
matchinput-interface
Input interface name
matchiprtp
Real-Time Transport Protocol (RTP) port
matchmplsexperimental
Multiprotocol Label Switching (MPLS) experimental (EXP) value
matchmplsexperimentaltopmost
MPLS EXP value in the topmost label
matchnot
Single match criterion value to use as an unsuccessful match criterion
matchpacketlength(class-map)
Layer 3 packet length in the IP header
matchport-type
Port type
matchprecedence
IP precedence values
matchprotocol
Protocol type
matchprotocol(NBAR)
Protocol type known to network-based application recognition (NBAR)
matchprotocolcitrix
Citrix protocol
matchprotocolfasttrack
FastTrack peer-to-peer traffic
matchprotocolgnutella
Gnutella peer-to-peer traffic
matchprotocolhttp
Hypertext Transfer Protocol
matchprotocolrtp
RTP traffic
matchqos-group
QoS group value
matchsource-addressmac
Source Media Access Control (MAC) address
matchstart
Datagram header (Layer 2) or the network header (Layer 3)
matchtag(class-map)
Tag type of class map
matchvlan(QoS)
Layer 2 virtual local-area network (VLAN) identification number
1 Cisco IOS match commands can vary by release and platform. For instance, as of Cisco IOS Release 12.2(31)SB2, the match vlan (QoS) command is supported on Cisco 10000 series routers only. For more information, see the command documentation for the Cisco IOS release and platform that you are using.
Traffic Classification Compared with Traffic Marking
Traffic classification and traffic marking are closely related and can be used together. Traffic marking can be viewed as an additional action, specified in a policy map, to be taken on a traffic class.
Traffic classification allows you to organize into traffic classes on the basis of whether the traffic matches specific criteria. For example, all traffic with a CoS value of 2 is grouped into one class, and traffic with DSCP value of 3 is grouped into another class. The match criterion is user-defined.
After the traffic is organized into traffic classes, traffic marking allows you to mark (that is, set or change) an attribute for the traffic belonging to that specific class. For instance, you may want to change the CoS value from 2 to 1, or you may want to change the DSCP value from 3 to 2.
The match criteria used by traffic classification are specified by configuring a
match command in a class map. The marking action taken by traffic marking is specified by configuring a
set command in a policy map. These class maps and policy maps are configured using the MQC.
The table below compares the features of traffic classification and traffic marking.
Table 2
Traffic Classification Compared with Traffic Marking
Traffic Classification
Traffic Marking
Goal
Groups network traffic into specific traffic classes on the basis of whether the traffic matches the user-defined criteria.
After the network traffic is grouped into traffic classes, modifies the attributes for the traffic in a particular traffic class.
Configuration Mechanism
Uses class maps and policy maps in the MQC.
Uses class maps and policy maps in the MQC.
CLI
In a class map, usesmatch commands (for example,
matchcos) to define the traffic matching criteria.
Uses the traffic classes and matching criteria specified by traffic classification.
In addition, uses
set commands (for example,
setcos) in a policy map to modify the attributes for the network traffic.
If a table map was created, uses the
table keyword and
table-map-name argument with the
set commands (for example,
setcosprecedencetabletable-map-name) in the policy map to establish the to-from relationship for mapping attributes.
Creating a Class Map for Classifying Network Traffic
Note
In the following task, the
matchfr-dlcicommand is shown in Step
4.
The
matchfr-dlcicommand matches traffic on the basis of the Frame Relay DLCI
number. The
matchfr-dlcicommand is just an example of one of the
match commands that can be used. For a list
of other
match commands, see
Creating a Class Map for Classifying Network Traffic.
SUMMARY STEPS
1.enable
2.configureterminal
3.class-mapclass-map-name [match-all|
match-any]
4.matchfr-dlcidlci-number
5.end
DETAILED STEPS
Command or Action
Purpose
Step 1
enable
Example:
Router> enable
Enables privileged EXEC mode.
Enter your password
if prompted.
Step 2
configureterminal
Example:
Router# configure terminal
Enters global configuration mode.
Step 3
class-mapclass-map-name [match-all|
match-any]
Example:
Router(config)# class-map class1
Creates a class map to be used for matching traffic to a
specified class, and enters class-map configuration mode.
Enter the class map
name.
Step 4
matchfr-dlcidlci-number
Example:
Router(config-cmap)# match fr-dlci 500
(Optional) Specifies the match criteria in a class map.
Note
The
matchfr-dlci command classifies traffic on the
basis of the Frame Relay DLCI number. The
matchfr-dlcicommand is just an example of one of the
match commands that can be used. For a
list of other
match commands, see
Creating a Class Map for Classifying Network Traffic.
Step 5
end
Example:
Router(config-cmap)# end
(Optional) Returns to privileged EXEC mode.
Creating a Policy Map for Applying a QoS Feature to Network Traffic
Note
In the following task, the
bandwidth command is shown at
Step 5
. The
bandwidth command configures the QoS feature
class-based weighted fair queuing (CBWFQ). CBWFQ is just an example of a QoS
feature that can be configured. Use the appropriate command for the QoS feature
you want to use.
Note
Configuring bandwidth on policies that have the class-default
class is supported on physical interfaces such as Gigabit Ethernet (GigE),
Serial, Mobile Location Protocol (MLP), and Multilink Frame-Relay (MFR), but it
is not supported on logical interfaces such as Virtual Access Interface (VAI),
Subinterface, and Frame-Relay on Virtual Circuits (FR-VC).
(Optional) Specifies or modifies the bandwidth allocated for a
class belonging to a policy map.
Enter the amount of
bandwidth as a number of kbps, a relative percentage of bandwidth, or an
absolute amount of bandwidth.
Note
The
bandwidth command configures the QoS
feature class-based weighted fair queuing (CBWFQ). CBWFQ is just an example of
a QoS feature that can be configured. Use the appropriate command for the QoS
feature that you want to use.
Step 6
end
Example:
Router(config-pmap-c)# end
Returns to privileged EXEC mode.
Step 7
showpolicy-map
(Optional) Displays all configured policy maps.
Step 8
or
Step 9
showpolicy-mappolicy-mapclassclass-name
Example:
(Optional) Displays the configuration for the specified class of
the specified policy map.
Create and configure as many policy maps as you need for your network. To create and configure additional policy maps, repeat the steps in the "Creating a Policy Map for Applying a QoS Feature to Network Traffic" section. Then attach the policy maps to the appropriate interface, following the instructions in the "Attaching the Policy Map to an Interface" section.
Attaching the Policy Map to an Interface
Note
Depending on the needs of your network, policy maps can be
attached to an interface, a subinterface, or an ATM PVC.
Configures an interface type and enters interface configuration
mode.
Enter the interface
type and number.
Step 4
pvc [name]
vpi/vci
[ilmi|qsaal|smds|
l2transport]
Example:
Router(config-if)# pvc cisco 0/16
(Optional) Creates or assigns a name to an ATM PVC, specifies the
encapsulation type on an ATM PVC, and enters ATM virtual circuit configuration
mode.
Enter the PVC name,
the ATM network virtual path identifier, and the network virtual channel
identifier.
Note
This step is required only if you are attaching the policy map
to an ATM PVC. If you are not attaching the policy map to an ATM PVC, advance
to
Step 6
.
Step 5
exit
Example:
Router(config-atm-vc)# exit
(Optional) Returns to interface configuration mode.
Note
This step is required only if you are attaching the policy map
to an ATM PVC and you completed
Step 4
. If you are not attaching the policy map to an ATM PVC,
advance to
Step 6
.
Step 6
service-policy
{input |
output}policy-map-name
Example:
Router(config-if)# service-policy input policy1
Attaches a policy map to an input or output interface.
Enter the policy map
name.
Note
Policy maps can be configured on ingress or egress routers.
They can also be attached in the input or output direction of an interface. The
direction (input or output) and the router (ingress or egress) to which the
policy map should be attached varies according your network configuration. When
using the
service-policy command to attach the
policy map to an interface, be sure to choose the router and the interface
direction that are appropriate for your network configuration.
Step 7
end
Example:
Router(config-if)# end
Returns to privileged EXEC mode.
Step 8
showpolicy-mapinterfacetypenumber
Example:
Router#
show policy-map interface serial4/0
(Optional) Displays the traffic statistics of all traffic classes
that are configured for all service policies either on the specified interface
or subinterface or on a specific PVC on the interface.
Enter the type and
number.
Step 9
exit
Example:
Router# exit
(Optional) Exits privileged EXEC mode.
Configuring QoS When Using IPsec VPNs
Note
This task is required only if you are using IPsec Virtual Private Networks (VPNs). Otherwise, this task is not necessary. For information about IPsec VPNs, see the "Configuring Security for VPNs with IPsec" module.
Note
This task uses the
qospre-classify command to enable QoS preclassification for the packet. QoS preclassification is not supported for all fragmented packets. If a packet is fragmented, each fragment might receive different preclassifications.
>
SUMMARY STEPS
1.enable
2.configureterminal
3.cryptomapmap-nameseq-num
4.exit
5.interfacetypenumber [name-tag]
6.qospre-classify
7.end
DETAILED STEPS
Command or Action
Purpose
Step 1
enable
Example:
Router> enable
Enables privileged EXEC mode.
Enter your password if prompted.
Step 2
configureterminal
Example:
Router# configure terminal
Enters global configuration mode.
Step 3
cryptomapmap-nameseq-num
Example:
Router(config)# crypto map mymap 10
Enters crypto map configuration mode and creates or modifies a crypto map entry.
Enter the crypto map name and sequence number.
Step 4
exit
Example:
Router(config-crypto-map)# exit
Returns to global configuration mode.
Step 5
interfacetypenumber [name-tag]
Example:
Router(config)# interface serial4/0
Configures an interface type and enters interface configuration mode.
Enter the interface type and number.
Step 6
qospre-classify
Example:
Router(config-if)# qos pre-classify
Enables QoS preclassification.
Step 7
end
Example:
Router(config-if)# end
(Optional) Returns to privileged EXEC mode.
Configuration Examples for Classifying Network Traffic
Example Creating a Class Map for Classifying Network Traffic
The following is an example of creating a class map to be used for traffic classification. In this example, a traffic class called class1 has been created. Traffic with a Frame Relay DLCI value of 500 will be put in this traffic class.
Example Creating a Policy Map for Applying a QoS Feature to Network Traffic
The following is an example of creating a policy map to be used for traffic classification. In this example, a policy map called policy1 has been created, and the bandwidth command has been configured for class1. The bandwidth command configures the QoS feature CBWFQ.
Router> enable
Router# configure terminal
Router(config)# policy-map policy1
Router(config-pmap)# class class1
Router(config-pmap-c)# bandwidth percent 50
Router(config-pmap-c)# end
Router#
show policy-map policy1 class class1
Router# exit
Note
This example uses the bandwidth command. The bandwidth command configures the QoS feature class-based weighted fair queuing (CBWFQ). CBWFQ is just an example of a QoS feature that can be configured. Use the appropriate command for the QoS feature that you want to use.
Example Attaching the Policy Map to an Interface
The following is an example of attaching the policy map to an interface. In this example, the policy map called policy1 has been attached in the input direction of serial interface 4/0.
The following is an example of configuring QoS when using IPsec VPNs. In this example, the cryptomap command specifies the IPsec crypto map mymap 10, to which the qospre-classify command is applied.
No new or modified RFCs are supported, and support for existing RFCs has not been modified.
--
Technical Assistance
Description
Link
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.
Feature Information for Classifying Network Traffic
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 3
Feature Information for Classifying Network Traffic
Feature Name
Releases
Feature Information
Packet Classification Based on Layer 3 Packet Length
12.2(13)T
This feature provides the added capability of matching and classifying network traffic on the basis of the Layer3 length in the IP packet header. The Layer 3 length is the IP datagram plus the IP header. This new match criteria is in addition to the other match criteria, such as the IP precedence, differentiated services code point (DSCP) value, class of service (CoS), currently available.
Packet Classification Using Frame Relay DLCI Number
12.2(13)T
The Packet Classification Using the Frame Relay DLCI Number feature allows customers to match and classify traffic based on the Frame Relay data-link connection identifier (DLCI) number associated with a packet. This new match criteria is in addition to the other match criteria, such as the IP Precedence, differentiated services code point (DSCP) value, class of service (CoS), currently available.
Quality of Service for Virtual Private Networks
12.2(2)T
The QoS for VPNs feature provides a solution for making Cisco IOS QoS services operate in conjunction with tunneling and encryption on an interface. Cisco IOS software can classify packets and apply the appropriate QoS service before the data is encrypted and tunneled. The QoS for VPN feature allows users to look inside the packet so that packet classification can be done based on original port numbers and based on source and destination IP addresses. This allows the service provider to treat mission critical or multi-service traffic with higher priority across their network.
QoS: Match VLAN
Note
As of Cisco IOS Release 12.2(31)SB2, the QoS: Match VLAN feature is supported on Cisco 10000 series routers only.
12.2(31)SB2
The QoS: Match VLAN feature allows you to classify network traffic on the basis of the Layer 2 virtual local-area network (VLAN) identification number.
The following commands were introduced or modified by this feature:
matchvlan(QoS),showpolicy-mapinterface.
Hierarchical Traffic Shaping
Packet Classification Based on Layer3 Packet-Length
QoS: Match VLAN
15.0(1)S
The Hierarchical Traffic Shaping, Packet Classification Based on Layer3 Packet-Length, QoS: Match VLAN features were integrated into the Cisco IOS Release 15.0(1)S release.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
1 Cisco IOS match commands can vary by release and platform. For instance, as of Cisco IOS Release 12.2(31)SB2, the match vlan (QoS) command is supported on Cisco 10000 series routers only. For more information, see the command documentation for the Cisco IOS release and platform that you are using.