Comments on: Cisco ASA QoS for VoIP Traffic

By: Cisco

Cisco — Tue, 28 Dec 2010 17:26:52 +0000

Priority queue will only apply to an interface in “outbound” direction.

In your example above. Please indicate ASA-2 outside interface with a priority queue applied to it’s outside interface matching traffic going from 192.168.2.0/24 to 192.168.1.0/24

By: BlogAdmin

BlogAdmin — Thu, 19 Nov 2009 18:00:37 +0000

fkento

Thanks for the comment. Usually the signaling control protocols (H323, SIP, and SCCP) use TCP ports for communication. H323 uses TCP 1720, SIP uses TCP port 5060 and the Cisco SCCP protocol uses TCP 2000. Sometimes I have seen devices using UDP also so yes you might be right that UDP should be configured also on the ACL in addition to TCP. For payload voice traffic, this is definitely UDP (Real Time Protocol-RTP).

Cheers

By: fkento

fkento — Thu, 19 Nov 2009 14:36:50 +0000

First of all, thanks for the great information on your site. It is very helpful. However, I just want to point out that I was having problems getting priority queuing to work so I called Cisco and they said priority queuing will not work unless you also implement traffic policing or shaping. Here is a good article that discusses both. http://tinyurl.com/yed7e6l

Also, your access list only matches tcp traffic and most VoIP traffic is udp so you’re probably not matching any packets with the current ACL. I changed mine to udp and it’s working now.

Thanks
Kent

By: BlogAdmin

BlogAdmin — Mon, 09 Nov 2009 06:20:26 +0000

Well guys the firewall I tested the above configuration on did not give me an error message. Maybe it depends on the software version. Anyway, my opinion is to forget about matching the DSCP EF value and use only the ACL matching. Since the ACL is very specific (i.e you match specific traffic with specific ports, h323,sip,2000) then you can be assured that you are only prioritizing voice traffic and nothing else. Also, matching on the DSCP value might not be a very reliable match since you depend on the voice source device which must set the DSCP value of the voice packets to EF.

By: fkento

fkento — Sun, 08 Nov 2009 21:58:42 +0000

I too am having the same problem as Wesley. When I try to add the second match, I get this

ERROR: Multiple match commands are not supported except for the ‘match tunnel-group or default-inspect-traffic’ command.

This seems to imply that you cannot have two match statements in a class-map. If that is true, how do you match traffic with Express Forwarding and the ACL?

Thanks for your help!

By: BlogAdmin

BlogAdmin — Tue, 19 May 2009 13:22:54 +0000

First of all, for the access list match you must create the ACL first and then use it in the match statement of the class-map. For the dscp value match, this should work just as I show in the example. If you still have problems for matching the dscp value, just leave the ACL match only.

Cheers
Harris

By: Wesley

Wesley — Mon, 18 May 2009 15:40:37 +0000

ASA-1(config)# class-map Voice-OUT
ASA-1(config-cmap)# match dscp ef
ASA-1(config-cmap)# match access-list VoIP-Traffic-OUT

I cannot add these 2 matches. Can you help me?