For Prioritizing SSH, Telnet, TACACS locally generated traffic on Cisco ASR running IOS XR, we have:

ssh server dscp 48
tacacs-server ipv4 dscp 48

Need the same for cisco GSR: 12416/PRP running IOS. Maybe we can use ip ssh precedence? If yes, how exactly?

  • There really is no reason to prioritize telnet. SSH and TACACS+ should probably set to the control class with a low-drop probability (something like af31).
    – Ron Maupin
    Commented Sep 17, 2019 at 12:12
  • I know the rannge for dscp is <0 to 63> and for af31, having 26 should do. But unable to get to do it using "tacacs-server ipv4 dscp" command on GSR 12000 series
    – Blake
    Commented Sep 17, 2019 at 12:28
  • I'm not completely sure about that router, but you normally would use ACLs and class maps to classify traffic and a policy map to assign the DSCP values, and you can actually use the AF values, e.g. set dscp af31.
    – Ron Maupin
    Commented Sep 17, 2019 at 12:35
  • on IOS you can use ip ssh dscp 48 for SSH connections. Dont know of any command that does the same for tacacs though...
    – Mario Jost
    Commented Sep 17, 2019 at 14:28

1 Answer 1


On Cisco devices running IOS, you can use the Quality of Service (QoS) features to prioritize different types of traffic based on Differentiated Services Code Point (DSCP) values. In your case, you want to prioritize SSH, Telnet, and TACACS traffic.

Here's how you can achieve this on a Cisco GSR 12416/PRP router:

Define ACLs: Define access control lists (ACLs) to match the traffic you want to prioritize. In this case, you want to match SSH, Telnet, and TACACS traffic. plaintext

access-list 101 permit tcp any any eq 22
access-list 101 permit tcp any any eq 23
access-list 101 permit tcp any any eq 49

Configure Class-Map: Create a class-map that matches the defined ACLs. This class-map will be used to identify traffic for QoS treatment. plaintext

class-map SSH-Telnet-TACACS
 match access-group 101

Configure Policy-Map: Create a policy-map that references the class-map you created and assigns the desired DSCP value for prioritization. In this case, you can set the DSCP value to 48. plaintext

policy-map SSH-Telnet-TACACS-POLICY
 class SSH-Telnet-TACACS
  set dscp 48

Apply Policy-Map: Apply the policy-map to the desired interface(s) to prioritize the specified traffic. plaintext

interface GigabitEthernet0/1
 service-policy input SSH-Telnet-TACACS-POLICY

In this example, the ACL 101 matches SSH traffic on port 22, Telnet traffic on port 23, and TACACS traffic on port 49. The class-map SSH-Telnet-TACACS matches traffic that matches the ACL, and the policy-map SSH-Telnet-TACACS-POLICY sets the DSCP value to 48 for the matched traffic. Finally, the policy-map is applied to the input of the desired interface using the service-policy input command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.