Thanks Peter! :)
What order are class-maps processed in?
In the order they appear in the policy-map attached to an interface.
If a packet hits a deny ACE in an ACL in a high priority class-map will it then look for matches in the remaining class-maps?
Yes, it will. The ACL in class-map is only a selector of matching packets for a particular class. If they don't match the criteria for this class (as they hit a "deny" ACE), they can still match other classes, and so the evaluation will continue.
With match-any class-maps are ACLs processed before NBAR protocol matches?
I suppose you are asking about a match-any class-map using both "match protocol" and "match access-group". On top of my mind, I do not know what "match" entry would be evaluated first. However, please let me ask you whether - and why - you believe this is important. The order of evaluation inside a class-map should not be important.
Yes exactly. Essentially I don't want any Bulk traffic leaking into the higher priority queues like Control and Transactional. I have noticed that if I don't deny 6882 (Bulk encrypted) traffic, 6882 traffic seems to leak into higher queues as NBAR seems to match some 6882 traffic as one of the encrypted protocols. I also still seem to be getting some leaks with the config in the first post. Hence the question about order of operations NBAR vs ACLs.
See excerpt below from config that is attempting to implement the following logic in, for example, the Transactional class-map (Bulk class-map and ACL included for added context)
Example logical operation for Transactional class-map
IF NOT using port 6882 AND protocol is ssl, set af31 AND IF using port 6882 AND protocol ssl, do not set af31, exit Transactional class-map evalution, continue evaluation in remaining class-maps as per order in policy-map
Config for Transactional class-map with deny ACL for any 6882 bulk traffic
!!@@ ACL for use on NBAR class-maps to ensure no bulk traffic is matched to higher priority queues via a protocol statement - positioned above all NBAR statements
ip access-list extended ACL_BULK_DENY
deny udp any eq 6882 any
deny udp any any eq 6882
deny tcp any eq 6882 any
deny tcp any any eq 6882
!!@@ Class-map for Transactional traffic - used to mark inbound traffic
class-map match-any CM_TRANSACTIONAL
description Transactional Data
match access-group name ACL_BULK_DENY !!@@ Do not match any Bulk traffic in case it matches as any of the below protocols
match protocol skype
match protocol http
match protocol secure-http
match protocol ssl
match protocol citrix
match protocol ftp
match protocol sftp
match protocol imap
match protocol pop3
match protocol smtp
match protocol exchange
match protocol secure-imap
match protocol secure-pop3
match protocol secure-smtp
match protocol gmail
match protocol youtube
match protocol dropbox
!!@@ ACL to match Bulk traffic for this network
ip access-list extended ACL_BULK_PERMIT
permit udp any eq 6882 any
permit udp any any eq 6882
permit tcp any eq 6882 any
permit tcp any any eq 6882
!!@@ Class-map for Bulk traffic - used to mark inbound traffic
class-map match-any CM_BULK
description Bulk Data
match access-group name ACL_BULK_PERMIT
