topic Re: 5506-X DSCP Filtering Capabilities in Network Security

5506-X DSCP Filtering Capabilities

BK2021 — Tue, 02 Mar 2021 19:28:03 GMT

Hi there,

I have been trying to implement DSCP filtering on a ASA 5506-X, using class maps. But have not been able to get it configured and working. It seems that the commands to do it are there, but looking at general DSCP filtering examples, I'm not able to get it working. Does anyone know if this device is able to do it?

Thanks ahead of time!

Re: 5506-X DSCP Filtering Capabilities

Sheraz.Salim — Wed, 03 Mar 2021 07:47:21 GMT

what software on the 5506-x you running? here cisco document on DSCP marking.

Re: 5506-X DSCP Filtering Capabilities

BK2021 — Wed, 03 Mar 2021 17:57:33 GMT

Hi Sheraz.Salim,

I am on a 5506-X, v9.10. Configuring through the CLI and not ASDM.

Initially this document is what I've been following. I have set it to match a couple of DSCP values, and thought that if we have this in the service policy, then it would prevent other DSCP values to be dropped at the outside interface, but all traffic is still flowing through.

Re: 5506-X DSCP Filtering Capabilities

Sheraz.Salim — Wed, 03 Mar 2021 18:02:31 GMT

could you please share your configuration. so I can have a look at it.

Re: 5506-X DSCP Filtering Capabilities

BK2021 — Wed, 03 Mar 2021 19:50:35 GMT

I just found out that the ASA does not support filtering traffic using DSCP. It will need to be done on a router.

Thanks for your time.

Re: 5506-X DSCP Filtering Capabilities

Sheraz.Salim — Wed, 03 Mar 2021 19:52:32 GMT

@BK2021 could you please share the link as it will help other too.