Wayne,

You can use NBAR to accomplish this requirement. However we need to know what exactly you are going to do. Let's say I want to drop traffic that starts with "www.cisco.com". Not sure why we have this requirement. (grin)

!

class-map match-all CISCO

match protocol http host "www.cisco.com*"

!

!

policy-map CANNOT_GO_CISCO

class CISCO

drop

!

int s0/0/0

service-policy output CANNOT_GO_CISCO

!

I cannot now go to "www.cisco.com" or "www.cisco.con/go/fn" or something like that.

You may use this example for your QOS plan(other methods)

HTH,

Toshi

That example would block traffic to that site, but I'd like to give that traffic priority over all other http traffic. Instead of dropping the packets in the policy-map, would setting the precedence to a high priority have the opposite effect?

It's only logical (to me) that I would then have to have all the other http traffic under some sort of qos as well, otherwise setting this policy for the one website does nothing...

Wayne,

Like I mentioned. It's just an example. You have to re-apply it with your QOS policies. Yes, You can mark it with ip precedence at the inbound interface then re-use it at the outbound interface with QOS methods you want.

HTH,

Toshi

as previously mentioned it would have been helpful to see what you already have.

here is an example I am using in production:

---omitted-----

Class internet-in

set dscp default

police 29 mbps 1000 kbyte conform-action transmit exceed-action drop

----omitted--------

basically I police traffic to 29Mb, allow a burst and mark with DSCP 0. in your case, you will need to add another class for XY.com and mark it with DSCP8 for example. how to classify XY http traffic is either by NBAR as suggested by other posters or use an ACL (which might cover more than one website). I prefer not to use NBAR personally.

Class XY_SITE

set dscp 8

police 5 mbps 1000 kbyte conform-action transmit exceed-action drop

Once again, this will only be guaranteed in your domain. once packets leave your cloud, Internet providers would likely change your http packets DSCP.

HTH

Sam

Thanks guys. This was very helpful, as it gives me multiple options.