How does class-map match?

Say if I have two class-maps, one is matching on IP address, the other one is matching on IP Precedence, what happens if a packet meets both criteria?  Which class-map it'll match?
I guess it'll be top-down (match the first class-map).  If that's the case, it'd be very difficult to prioritize the class-maps as they don't have line numbers as ACLs, which you can delete/insert the class-map at a specific location in the config.
Thanks!

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
Policy-map classes are processed in sequence.
Yes, edits can be difficult, as you may need to drop and redefine multiple classes.  (But we had to do that for ACLs years ago too.  Fortunately, policy-map classes cannot run into the thousands.)

Similar Messages

  • 3850 QoS class-map match-all?

    I would like to create a QoS marking policy that re-marks packet to CS5 if the inbound traffic is SIP *and* if it is marked CS3 when it comes in.  I would have expected the configuration listed below will work.  I only found out when I tried to apply the config that, unlike other IOS devices, "class-map match-all" does not exist in 3850 3.3.x code.  It can only do "class-map match-any" Can anyone suggest a work-around config for 3850 to achieve the same end result?
    ip   access-list extended ACL-QOS-SIP
    permit tcp any range 5060 5061 any
    permit tcp any any range 5060 5061
    ip   access-list extended ACL-QOS-CS3
    permit ip any any dscp cs3
    class-map   match-all CM-QOS-CS5
      match access-group name ACL-QOS-CS3
      match access-group name ACL-QOS-SIP
    policy-map   PM-QOS-MARKING
    class CM-QOS-CS5
         set ip dscp cs5
    Any suggestions would be appreciated.

    jlkeys,  below is configuration I ended up using to resolve the issue:
    ip access-list extended ACL-QOS-SIP
     permit tcp any range 5060 5061 any dscp cs3
    class-map match-any CM-QOS-CS5
      match access-group name ACL-QOS-SIP
    policy-map   PM-QOS-MARKING
     class CM-QOS-CS5
       set ip dscp cs5

  • How does mix and match works in ECC6.0?

    How does mix and match works in ECC 6.0?
    Can some shared on this topic?
    Thanks in advance

    It;s a term used in Retail for combination of sales item eg buy 3 get 1 any other  @ xx price.

  • Transfer Rules: How does the mapping work?

    Transfer Rules: How does the mapping work?
    Is there a document out there that explains the following or can someone help clarify it for me. I have some confusion on what is really going on.
    When I create an InfoSource (IS_Test)  as a “Flexible update…”  and then “Assign DataSource”  (DS_Test) and I respond Yes, to the message “DataSource assignment DS_Test to InfoSource IS_Test Save”
    a) <b>Under “Transfer_Structure/Transfer_Rules”</b> in the InfoSource
    1)  the “Transfer Rules” tab, what are the fields found in the right column (Assigned InfObjct-field)? And where do the fields you enter in the left column (<b>Communication Str/</b>Transfer rules) eventually go?
    2)  the “DataSource /Trans. Structure” tab, can I always assume that all the fields in the right column (DataSource) came from DS_Test? The left column (Transfer Structure), in my test was exactly the same as on the right. Where do these fields eventually go?
    b) Under “<b>Communication_Struct.”,</b> in the InfoSource
    3. the right column (ISource Fileds) where from those InfoObjects. if I am now creating my InfoSource. Where did they come from?
    4. The left column is “<b>Communication Structure</b>”, which at this point has no InfoObjects, if I move a couple of InfoObjects from the right to the left, where do these Objects in the left eventually go?
    5. what is the relationship between the “Communication Structure” in 4 and 1? Or any relationship between a) and b) as a whole?
    Thanks.

    Hi Caud,
    As Ashish pointed out, communication structure contains fields (infoobjects) that suppose to go to data targets. Which IO in CS to which IO in the data target will go (and what transformation of data may occur) is determined in URs of the data target.
    The transfer structure is the structure in which the data is transported from the source system into BW:
    http://help.sap.com/saphelp_bw33/helpdata/en/3f/0e503c3c0d563de10000000a114084/frameset.htm
    In “Transfer_Structure/Transfer_Rules” in the IS, DataSource /Trans. Structure” tab, right part shows fields in the Datasource, the left part – fields in the transfer structure. There is also a transfer structure in R/3 for a given DS. Transfer structure in BW is created identical to the TS in R/3 during TRs activation.
    During data load data are transferred 1:1 from TS in R/3 to TS in BW.
    TS in BW corresponds to the PSA table structure.
    How data from PSA are transferred to the CS is determined in TRs.   
    The 3rd column (“Field”) (“Transfer Rules” tab, right part (Assigned InfObjct-field)), contains field names of the DS (TS); and the 1st column shows IO in the CS to which the DS field will go. So, it’s a mapping DS filed -> CS field.
    The left part (“Communication str./Transfer rules”) is always identical to the CS content. But the 4th column (“Tp”) shows possible data transformation during transfer from PSA to CS. If this column contains a yellow triangle then there is no transformation (Value of DS field will go to value of CS field). If there is a red cross, it means that no data for this CS field is supplied from a DS. You can click on this yellow triangle and choose: 1). Another field from a DS; 2). Constant; 3). ABAP routine; 4). Formula. So, here you can determine the data transformation. Moreover, there is a possibility to create a start routine (blank sheet icon at the top).
    And finally, here are the answers on your questions:
    Q:
    a)     Under “Transfer_Structure/Transfer_Rules” in the InfoSource
    1) the “Transfer Rules” tab, what are the fields found in the right column (Assigned InfObjct-field)? And where do the fields you enter in the left column (Communication Str/Transfer rules) eventually go?
    A: Right part shows a mapping between DS and CS fields. Left part shows CS fields and data transformation (TRs) during data transfer from TS (PSA) to the CS. These are fields in the CS that will go to data target and which are fed from a TS (DS).
    Q: 2) the “DataSource /Trans. Structure” tab, can I always assume that all the fields in the right column (DataSource) came from DS_Test?
    A: Yes, you are right.
    Q: The left column (Transfer Structure), in my test was exactly the same as on the right. Where do these fields eventually go?
    A: As I described, left and right parts are identical. These fields will go to CS.
    Q: b) Under “Communication_Struct.”, in the InfoSource
    3. the right column (ISource Fileds) where from those InfoObjects. if I am now creating my InfoSource. Where did they come from?
    A: these are fields from an IS template, the name of this template you can see above this right part.  Actually, during IS (CS) creation you can choose different templates and choose fields from them transferring them into the left part.
    Q: 4. The left column is “Communication Structure”, which at this point has no InfoObjects, if I move a couple of InfoObjects from the right to the left, where do these Objects in the left eventually go?
    A: these are fields of CS (left part) and as I said before they will go to data target.
    Q: 5. what is the relationship between the “Communication Structure” in 4 and 1? Or any relationship between a) and b) as a whole?
    A: CS in 4 just shows IOs that will be transferred to data target. CS in 1 also shows how values for CS IOs are to be fed and transformed.
    Best regards,
    Eugene
    Message was edited by: Eugene Khusainov

  • I migrated all data from old PC to new and iTunes successfully transferred to new PC. When I click on a song it says it cannot locate the original. How does one map iTunes file to iMusic to enable play from original files ?

    Subject: Migration
    I migrated all data from old PC to new and iTunes successfully transferred to new PC. When I click on a song it says it cannot locate the original. How does one map iTunes file to iMusic to enable play from original files ?

    Subject: Migration
    I migrated all data from old PC to new and iTunes successfully transferred to new PC. When I click on a song it says it cannot locate the original. How does one map iTunes file to iMusic to enable play from original files ?

  • ACE class-map match url syntax

    Can someone help me with the string that would match a url with no path specified?  For instance; user types "https://outlook.domain.net" into their browser and I want the ACE to redirect that request to https://outlook.domain.net/owa".
      2 match http url oulook\.domain\.net\

    Adam and Shday,
    I'll give you a hand on this =)
    Adam we can solve your problem only if you're doing SSL offloading on the ACE as the layer 5 information that needs to be checked is being sent encrypted.
    In case SSL termination is configured then the configuration would be like this:
    rserver redirect OWA
      webhost-redirection https://%h/owa 301
      inservice
    serverfarm redirect OWA
      rserver OWA
        inservice
    class-map type http loadbalance match-any OWA
    2 match http header Host header-value "outlook.domain.net"
    policy-map type loadbalance first-match OWA
    class OWA
      serverfarm OWA
    class class-default
      serverfarm Backend
    Shday yours is pretty much the same but you need to decide if class-default needs
    to be in place:
    rserver redirect Domain
    webhost-redirection http://%h/any_path 301
    inservice
    serverfarm redirect Domain
       rserver Domain
         inservice
    class-map type http loadbalance match-any Any
    2 match http url /.*
    class-map type http loadbalance match-any Domain
    2 match http header Host header-value "domain.com"
    policy-map type loadbalance first-match Domain
    class Any
      serverfarm Backend
    class Domain
      serverfarm Domain
    HTH
    Pablo

  • How does nokia maps work? BACKEND

    Hello everybody,
    When u give the location coordinates to nokia maps, it will find out the location on the earth and zoom to the point. How does this work, wht is the backend where we can do these manipulations...
    Can u please help me with this..

    Refer these threads..
    /t5/Maps-Navigation-and-GPS/Ovi-maps-when-offline-search-not-working/m-p/614321/highlight/true#M1668...
    /t5/Maps-Navigation-and-GPS/No-offline-search-OVI-Maps/m-p/644579/highlight/true#M19586
    /t5/Maps-Navigation-and-GPS/ovi-map-search-offline-problem/m-p/741575/highlight/true#M26571
    ..and you are getting charged for using the Internet (Packet data) by your service provider and not by Nokia /OVI..
    --------------------------------------------------​--------------------------------------------------​--------------------------------------------------​--If you find this helpful, pl. hit the White Star in Green Box...

  • How does Class.forName() get a driver registered with DriverManager

    From the documentation, Class.forName() tends to loads the specified class via the class loader. But if we use it to load the class of a jdbc connection driver, how does it get automatically registered with DriverManager?
    Neerav

    yorkroad wrote:
    No. Class.ForName("whatever") intializes the class. As for registering it with the DriverManager, this is from the API:
    When the method getConnection is called, the DriverManager will attempt to locate a suitable driver from amongst those loaded at initialization and those loaded explicitly using the same classloader as the current applet or application.
    You could use DriverManager.registerDriver (new oracle.jdbc.driver.OracleDriver()); which does it all in one. (Although keep in mind that will require an Oracle import in your code!)
    m
    Edited by: yorkroad on Nov 4, 2009 3:42 PMNo, loading the Class with Class.forName already registers the driver, as already said. Where DriverManager "searches" is among those registered classes. The method detailed above does not do anything more than simply calling Class.forName() with the added drawback that the Driver jarfile must be present at compile time, and, in order to change DBs you would have to change and recompile your code.

  • QoS Class-Map Matching

    Hello,
    When configuring a class-map, I want to match based on DSCP values.  I see that I can configure the match statement either as "match dscp" or "match ip dscp".  The router accepts either one.  Is there a difference between these two, or do they accomplish the same thing?

    Hi,
    "match dscp" matches both IPv4 and IPv6 traffic while "match ip dscp" matches only IPv4 traffic.
    HTH,
    Nagendra

  • HT204146 How does the Itunes Match works in family sharing

    If i subscribe for itunes match the rest of the family member in family sharing get also the suscription even without sharing the songs?

    HI,
    Family sharing does not work for iTunes match. Which purchased content can I share using Family Sharing - Apple Support
    Jim

  • How does auth_rewrite mapping work?

    Am tryng out some functionality of auth_rewrite maping but am not sure I am getting anywhere.
    Created an auth_rewrite mapping:
    *|*|*|* $N
    specify authrewrite 8 in the tcp_auth channel. Refreshed config and send a SASL authenticated message. The message enqueued from tcp_auth and dequeued accordingly. Shouldn't $N in my auth_rewrite mapping be rejecting any message regardless? Or am i missing something?
    Version of JMS:
    [root@memtstlnx03 messaging]# sbin/imsimta version
    Sun Java(tm) System Messaging Server 6.2 (built Nov 24 2004)
    libimta.so 6.2 (built 00:22:01, Nov 24 2004)
    Linux memtstlnx03.bankofamerica.com 2.4.9-e.57smp #1 SMP Thu Dec 2 20:51:12 EST 2004 i686 unknown
    Victor

    Auth_rewrite section of mappings table:
    AUTH_REWRITE
    *|*|*|*        $NAlso, section of imta.cnf:
    ! tcp_auth
    tcp_auth smtp mx single_sys mustsaslserver missingrecipientpolicy 4 authrewrite 24
    tcp_auth-daemon(I did try authrewrite 8,16 and 24 but none of which works)
    Output from test mapping -debug:-
    [root@memtstlnx03 messaging]# sbin/imsimta test -mapping -debug
    Enter table name: auth_rewrite
    Input string: user|user|user|user
    22:47:06.75: Mapping 4 applied to user|user|user|user
    22:47:06.75: Entry #1 matched, pattern "*|*|*|*", template "$N", match #0.
    22:47:06.75: New target ""
    22:47:06.75: Exiting...
    22:47:06.75: Final result ""
    Output string:
    Output flags: [0, 'N' (78)]
    Victor

  • How does the Maps app work?

    I'm considering buying the software upgrade, but I don't understand how the maps application can possibly work. It requires wi-fi, so how will it work when you're trying to get somewhere and you're driving? Certainly there's no wi-fi in the car!
    Can anyone explain this to me? Thanks!

    You could just drive into a sub-division and hope somebody has an unprotected wireless network when you are lost...
    The map app was originally made for the iPhone which with the unlimited data plan through At&T it can update the map and search on the fly as long as you are in a service area. Unfortunately for the ipod the map app is not as powerful as the iPhone because you can't get a map anywhere, it is the same app, but you get the idea.

  • How does the map know where I am exactly

    Ok I click on map and find my location and exactly correct it knows my location. Even though the ip address is located in another state. Wondering how it knew the location.

    It uses the registered addresses of the wi-fi routers that it can see.
    From the manual:
    "iPod touch uses location services to determine your location. Location services uses available information from local Wi-Fi networks (if Wi-Fi is turned on). "
    http://manuals.info.apple.com/enUS/iPod_touch_iOS4_UserGuide.pdf

  • How does CQ map content (cq:Page) to its resourceType under jcr:content (cq:PageContent)?

    I have a /sling/servlet/default servlet registered with selector defined as "myselector" to serve both GET and POST requests. The component pointed to through resourceType also has a script called myselector.jsp. When the url is http://.../content.myselector.html, requests are always served by the servlet, but if the url is http://../content/_jcr_content.myselector.html, then myselector.jsp will  process the request. Just wonder what's really going on here. And if the custom servlet type is NOT /sling/servlet/default, what's going to happen in terms which will be used to process requests? It seems some magic logic is applied to map from resource (content) to the rendering servlet or scripts. Any explanation is appreciated.

    cq:Page has own set of scripts which you can find under /libs/foundation/components/primary/cq/Page
    See http://dev.day.com/content/kb/home/cq5/Development/CQ5Templates/CQ53HowToAddACustomPageExt ension.html for details, hope this will help.

  • Class-map does not support match protocol ssl

    I have several 1941/k9's that do not have the class-map command: to suppot ssl.  System image is c1900-universalk9-mz.SPA.152-1.T.bin.
    class-map match-any af31
    match protocol ssl  <-- missing.
    I did some google searches but come up with nothing. 
    Is the fix to upgrade IOS?  I have found it on other routers running c1900-universalk9-mz.SPA.152-4.M4.bin.  I would just upgrade and check but have an extensive change review board with questions before doing so.
    Thanks for advice,
    Haydn

    Disclaimer
    The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
    Liability Disclaimer
    In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
    Posting
    I'm not current on NBAR (or NBAR 2), but NBAR used to support loadable modules (PDMs?).  Sometimes Cisco would provide those so you could add match protocols without upgrading your IOS.
    Otherwise the "fix" would be to upgrade your IOS.
    Lastly, depending on what it matching SSL really means to you, using port based ACLs might suffice (in fact, some NBAR match protocol is only really that, but some NBAR matches regardless of the port usage).
    PS:
    Also on the subject of SSL, don't forget much can use it.  I once matched on it for the purposes of providing secure shell higher queuing priority, worked great for SSH, not so great when secure copy (SCP) also matched against it.

Maybe you are looking for