4

I have a SIP Server that does not put a DSCP code on it's traffic. This server is behind an ASA, and I want to prioritize its traffic passing through an ASA from the private to public network.

I am using the ASA shape feature, and have it set to prioritize "EF AF31" DSCP.

I am assuming I would use and ACL to match the traffic, but then would I use a class map / policy map to mark the traffic on the inside, before it passes through the shaper?

Improve this question

2 Answers 2

Reset to default
3

To my knowledge, the ASA platform is only able to classify based on existing DSCP markings, not apply or change them.

It does preserve existing markings, though.

Improve this answer
4
  • Is a managed switch able to set DSCP? What could I use to mark the traffic?
    – Blake
    Jun 18, 2013 at 18:11
  • Obviously very dependent on the vendor and model of switch, but generally yes. For instance, many of the Cisco Catalyst family is able to do this via the MQC command line, which allows you to mark using class-maps and policy maps.
    – Mierdin
    Jun 18, 2013 at 18:18
  • @blake, please ask a separate question about switch qos... please include the vendor and model of switch... if it's a chassis switch, also include the specific linecard model number
    – Mike Pennington
    Jun 18, 2013 at 21:12
  • Beware of using a switch thats not a ME or WAN switch. A lot of the LAN catalyst ranges have limited QoS capabilities @ layer 3 and are really limited to layer 2 QoS and COS-DSCP marking type functionality. If you're looking to identify the traffic (possibly dynamically via NBAR) at layer 4 onwards then mark I would defo recommend a router or a ME series.
    – wintermute000
    Jun 22, 2013 at 11:50
5

ASA's can preserve DSCP and match traffic based on the DSCP markings, but it does not have the ability to mark/change DSCP.

Your best bet would be to place a switch (or other device) that can mark DSCP before the ASA to mark your traffic.

However, I do want to note that if the "public" network on the ASA is to a service provider (as is often the case) that unless your contract specifies that they will honor QoS/DSCP, they will often mark all ingress packets from your network with their own default, negating your own DSCP markings (and the same can be true of their upstream providers or peers).

So if you want them to be used for other than matching traffic on the ASA, you would need to check that your provider (and theirs) will honor them (as well as which values they will honor). Usually this is the hardest part of dealing QoS on public networks.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.