Prioritizing SSH, Telnet, TACACS in Cisco IOS

Question

For Prioritizing SSH, Telnet, TACACS locally generated traffic on Cisco ASR running IOS XR, we have:

ssh server dscp 48
tacacs-server ipv4 dscp 48

Need the same for cisco GSR: 12416/PRP running IOS. Maybe we can use ip ssh precedence? If yes, how exactly?

Answer 1

On Cisco devices running IOS, you can use the Quality of Service (QoS) features to prioritize different types of traffic based on Differentiated Services Code Point (DSCP) values. In your case, you want to prioritize SSH, Telnet, and TACACS traffic.

Here's how you can achieve this on a Cisco GSR 12416/PRP router:

Define ACLs: Define access control lists (ACLs) to match the traffic you want to prioritize. In this case, you want to match SSH, Telnet, and TACACS traffic. plaintext

access-list 101 permit tcp any any eq 22
access-list 101 permit tcp any any eq 23
access-list 101 permit tcp any any eq 49

Configure Class-Map: Create a class-map that matches the defined ACLs. This class-map will be used to identify traffic for QoS treatment. plaintext

class-map SSH-Telnet-TACACS
 match access-group 101

Configure Policy-Map: Create a policy-map that references the class-map you created and assigns the desired DSCP value for prioritization. In this case, you can set the DSCP value to 48. plaintext

policy-map SSH-Telnet-TACACS-POLICY
 class SSH-Telnet-TACACS
  set dscp 48

Apply Policy-Map: Apply the policy-map to the desired interface(s) to prioritize the specified traffic. plaintext

interface GigabitEthernet0/1
 service-policy input SSH-Telnet-TACACS-POLICY

In this example, the ACL 101 matches SSH traffic on port 22, Telnet traffic on port 23, and TACACS traffic on port 49. The class-map SSH-Telnet-TACACS matches traffic that matches the ACL, and the policy-map SSH-Telnet-TACACS-POLICY sets the DSCP value to 48 for the matched traffic. Finally, the policy-map is applied to the input of the desired interface using the service-policy input command.