Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

QOS - match flow ip destination-address

                   I need someone to help me understand something. I have read several sources and they appear to state that this command has changed over the ASA versions so now I have no real idea if it works as I think.

    I am using QOS over ASA tunnels - code level 8.2.5.  I have a class for only tunneled-packets and I want to police (rate limit) the tunneled packets - not individual flows within the tunneled data. From what I gather this command will not do that. Example if I have five users in the tunnel all sending a lot of date to each of their 5 unique destination addresses with a police output of 10Mb, I think I could actually have 50 Mb going through that tunnel at one time. Is this correct?

I think I need to discard this command use a match access-list where the source and destinations are the subnets of the VPN sites that would go through this tunnel. That way I police all the packets in the tunnel to the set limit. Is this reasonnign correct??   Thanks.

1 ACCEPTED SOLUTION

Accepted Solutions

Re: QOS - match flow ip destination-address

Hello,

Exactly.

Actually starting on 8.2.1 is a MUST when using policing and matching tunnel groups to have this keyword and YES it will match individual flows

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Looking for some Networking Assistance? Contact me directly at jcarvaja@laguiadelnetworking.com I will fix your problem ASAP. Cheers, Julio Carvajal Segura http://laguiadelnetworking.com
2 REPLIES
New Member

QOS - match flow ip destination-address

I think I found my answer.

It does apply to individual flow according to the 8.2.5 command reference.

Thanks

Re: QOS - match flow ip destination-address

Hello,

Exactly.

Actually starting on 8.2.1 is a MUST when using policing and matching tunnel groups to have this keyword and YES it will match individual flows

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Looking for some Networking Assistance? Contact me directly at jcarvaja@laguiadelnetworking.com I will fix your problem ASAP. Cheers, Julio Carvajal Segura http://laguiadelnetworking.com
288
Views
0
Helpful
2
Replies