In which configuration mode is class-map match-all [name] used?

The class-map match-all [name] command is entered in Global Config mode on Cisco IOS devices.

QoSGlobal Config

class-map match-all [name]

Creates a class map that matches packets based on multiple match criteria, requiring all conditions to be true (logical AND) for traffic classification in QoS policies.

Definition: class-map match-all [name] is a Cisco IOS global config command. Creates a class map that matches packets based on multiple match criteria, requiring all conditions to be true (logical AND) for traffic classification in QoS policies.

Overview

The `class-map match-all [name]` command is a fundamental building block for Quality of Service (QoS) configuration on Cisco IOS devices. It creates a class map that defines a traffic class by specifying multiple match criteria, all of which must be satisfied for a packet to belong to that class (logical AND). This command is essential for granular traffic classification, enabling network engineers to apply differentiated treatment to specific traffic flows.

QoS is critical in modern networks to ensure that critical applications (e.g., voice, video, real-time data) receive appropriate bandwidth, low latency, and minimal jitter, while less important traffic (e.g., bulk file transfers) can be limited or deprioritized. The class-map command is used in conjunction with policy-map and service-policy to implement end-to-end QoS policies. Network engineers reach for this command when they need to classify traffic based on multiple attributes such as source/destination IP, protocol, port numbers, DSCP values, or even non-IP criteria like MAC addresses.

The match-all variant is particularly useful when traffic must meet a combination of conditions to be treated as a specific class; for example, you might want to match traffic that is both HTTP (TCP port 80) and destined to a specific subnet. In contrast, the match-any variant requires only one condition to be true (logical OR). The choice between match-all and match-any depends on the classification logic required.

The class-map command is typically used in the configuration workflow after defining access-lists or match criteria, then applied within a policy-map where actions like bandwidth reservation, policing, or marking are specified. The policy-map is then attached to an interface using the service-policy command. Important IOS behaviors: the class-map is stored in the running configuration and can be viewed with `show class-map`.

There is no specific privilege level requirement beyond privileged EXEC (enable mode) for configuration, but the command is only available in global configuration mode. The command does not produce buffered output; it directly modifies the running config. Misconfiguration can lead to unexpected traffic classification, so careful planning of match criteria is essential.

The class-map command is supported in both IOS and IOS-XE, with similar syntax, but note that in some versions, the match-all keyword is optional; if omitted, the default behavior is match-all. However, it is best practice to explicitly specify match-all for clarity. This command is a cornerstone for QoS and is heavily tested in CCNA and CCNP exams, requiring a deep understanding of its parameters and interaction with other QoS components.

Syntax·Global Config

class-map match-all [name]

When to Use This Command

Classify VoIP traffic by matching both DSCP EF and UDP port range 16384-32767 to ensure priority queuing.
Identify mission-critical database traffic by matching source IP subnet 10.1.1.0/24 and destination TCP port 1521.
Isolate video conferencing traffic by matching both DSCP AF41 and RTP port range 10000-20000.
Classify management traffic by matching protocol SSH (TCP/22) and destination IP 192.168.1.0/24.

Parameters

Parameter	Syntax	Required	Description
name	WORD (class-map name)	Required	The name of the class map. This is a user-defined string that identifies the traffic class. It must be unique within the device and can contain letters, numbers, and hyphens. Common mistakes include using spaces or special characters, which are not allowed. The name is used later in policy-map configuration to reference this class.

Command Examples

Classify VoIP traffic with DSCP and UDP port

class-map match-all VOIP
 match ip dscp ef
 match ip udp range 16384 32767

Router(config-cmap)# class-map match-all VOIP
Router(config-cmap)# match ip dscp ef
Router(config-cmap)# match ip udp range 16384 32767
Router(config-cmap)# exit
Router(config)# do show class-map VOIP
Class Map match-all VOIP (id 1)
   Match criteria:
      ip dscp: ef (46)
      ip udp range 16384 32767
   Description:

The class-map is named VOIP and uses match-all (AND). The output shows two match statements: DSCP EF (46) and UDP ports 16384-32767. Both must match for a packet to belong to this class.

Classify database traffic with source subnet and TCP port

class-map match-all DB_TRAFFIC
 match access-group name DB_ACL
 match ip dscp af31

Router(config-cmap)# class-map match-all DB_TRAFFIC
Router(config-cmap)# match access-group name DB_ACL
Router(config-cmap)# match ip dscp af31
Router(config-cmap)# exit
Router(config)# do show class-map DB_TRAFFIC
Class Map match-all DB_TRAFFIC (id 2)
   Match criteria:
      access-group: name DB_ACL
      ip dscp: af31 (26)
   Description:

This class-map uses an ACL named DB_ACL (which could match source subnet and TCP port) combined with DSCP AF31. Both conditions must be true. The output shows the match criteria.

Understanding the Output

The 'show class-map [name]' command displays the class-map configuration. The 'Class Map match-all' line indicates the name and match type (match-all = AND). The 'id' is an internal identifier.

Under 'Match criteria', each match statement is listed. For 'ip dscp', the value and numeric code are shown (e.g., ef (46)). For 'access-group', it shows the ACL name.

For 'ip udp range', it shows the port range. If a match is not configured, it will not appear. A properly configured class-map should have at least one match statement.

Missing match statements or incorrect syntax will cause errors when applying the policy-map. In production, verify that the class-map matches the intended traffic using 'show policy-map interface' to see packet counters.

Configuration Scenarios

Classify HTTP traffic from a specific subnet for bandwidth guarantee

A company wants to ensure that web traffic (HTTP/HTTPS) originating from the 192.168.1.0/24 subnet receives a minimum bandwidth guarantee of 10 Mbps on a WAN link. This requires creating a class map that matches both the source subnet and the HTTP/HTTPS ports.

Topology

R1(Gi0/0)---192.168.1.0/24 (internal) ; R1(Gi0/1)---WAN

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Create an access-list to match the source subnet: ip access-list extended MATCH_SUBNET permit ip 192.168.1.0 0.0.0.255 any
3.Step 3: Create the class map with match-all: class-map match-all HTTP_SUBNET
4.Step 4: Match the access-list: match access-group name MATCH_SUBNET
5.Step 5: Match the HTTP and HTTPS ports: match protocol http and match protocol https (or use match tcp port 80 443)
6.Step 6: Exit class-map configuration: exit
7.Step 7: Create a policy-map to apply bandwidth: policy-map QOS_POLICY class HTTP_SUBNET bandwidth 10000
8.Step 8: Attach the policy-map to the WAN interface: interface GigabitEthernet0/1 service-policy output QOS_POLICY
9.Step 9: Exit and save configuration: end, write memory

Configuration

! IOS Config
ip access-list extended MATCH_SUBNET
 permit ip 192.168.1.0 0.0.0.255 any
!
class-map match-all HTTP_SUBNET
 match access-group name MATCH_SUBNET
 match protocol http
 match protocol https
!
policy-map QOS_POLICY
 class HTTP_SUBNET
  bandwidth 10000
!
interface GigabitEthernet0/1
 service-policy output QOS_POLICY
!

Verify: Use 'show class-map HTTP_SUBNET' to verify the class map configuration. Use 'show policy-map interface GigabitEthernet0/1' to see traffic statistics and bandwidth allocation.

Watch out: The match protocol command may not be available in all IOS versions; an alternative is to use match tcp port 80 443. Also, ensure the access-list is correctly referenced with the name keyword.

Classify VoIP traffic using DSCP and IP precedence for priority queuing

A branch office needs to prioritize VoIP traffic (RTP) marked with DSCP EF (46) or IP precedence 5. The class map must match either DSCP or IP precedence (since both are used interchangeably), but the match-all requires both conditions to be true. However, since a packet cannot have both DSCP EF and IP precedence 5 simultaneously (they are the same value), the match-all would never match. Therefore, this scenario demonstrates a common pitfall and the need for match-any instead. For the purpose of this exercise, we will show a correct match-any configuration for VoIP.

Topology

R2(Gi0/0)---LAN (VoIP phones) ; R2(Gi0/1)---WAN

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Create a class map with match-any (since we want either DSCP or IP precedence): class-map match-any VOIP
3.Step 3: Match DSCP EF: match dscp ef
4.Step 4: Match IP precedence 5: match ip precedence 5
5.Step 5: Exit class-map: exit
6.Step 6: Create a policy-map to prioritize: policy-map QOS_POLICY class VOIP priority 1000
7.Step 7: Attach to WAN interface: interface GigabitEthernet0/1 service-policy output QOS_POLICY
8.Step 8: End and save: end, write memory

Configuration

! IOS Config
class-map match-any VOIP
 match dscp ef
 match ip precedence 5
!
policy-map QOS_POLICY
 class VOIP
  priority 1000
!
interface GigabitEthernet0/1
 service-policy output QOS_POLICY
!

Verify: Use 'show class-map VOIP' to verify. Use 'show policy-map interface GigabitEthernet0/1' to check that VoIP traffic is being matched and prioritized.

Watch out: Using match-all with both DSCP and IP precedence will never match because a packet cannot have both set to the same value; they are mutually exclusive. Always use match-any when matching different fields that represent the same marking.

Troubleshooting with This Command

When troubleshooting class-map configurations, the primary command is `show class-map [name]` which displays the configured match criteria. A healthy output shows the class-map name, type (match-all or match-any), and the list of match statements. If the class-map is not matching traffic as expected, check the following: First, verify that the class-map is referenced in a policy-map and that the policy-map is applied to the correct interface and direction (input or output).

Use `show policy-map interface [interface]` to see packet counters for each class. If the class counter shows zero packets, the match criteria are not being met. Common issues include: incorrect access-list (check with `show access-lists`), wrong protocol or port numbers, or using match-all when match-any is needed.

For example, if you have `match dscp ef` and `match ip precedence 5` in a match-all class, no packet will ever match because a packet cannot have both DSCP EF and IP precedence 5 simultaneously; they are the same value but stored in different fields. In such cases, use match-any. Another common mistake is forgetting to include the `match-all` keyword; if omitted, the default is match-all, but it's best to be explicit.

Also, ensure that the class-map name is correctly spelled in the policy-map. Use `debug policy-map` to see real-time matching decisions, but be cautious in production as it can be CPU-intensive. Correlate the class-map output with `show ip nbar protocol-discovery` if using NBAR for protocol matching.

For complex classifications, verify that the access-list entries are correct and that the order of match statements does not matter (all must match for match-all). If the class-map is used for marking, check that the marking is applied correctly with `show policy-map`. Finally, remember that class-maps are local to the device; they do not affect routing or switching decisions outside of QoS.

By systematically verifying each component (class-map, policy-map, service-policy), you can isolate and resolve classification issues.

CCNA Exam Tips

Remember: match-all requires ALL conditions to match (logical AND); match-any requires ANY condition to match (logical OR).

The class-map name is case-sensitive and must be unique; spaces are not allowed.

You cannot use 'match ip dscp' and 'match ip precedence' in the same match-all class-map; they are mutually exclusive.

CCNA exam may ask you to identify the correct class-map type for a given QoS requirement (e.g., VoIP needs DSCP EF AND UDP port).

Common Mistakes

Using match-all when match-any is needed, causing traffic to not be classified because not all conditions are met.

Forgetting to enter the class-map sub-configuration mode before adding match statements, resulting in syntax errors.

Mixing match types like 'match ip dscp' and 'match ip precedence' in the same class-map, which is invalid.

class-map match-all [name] vs class-map match-any [name]

These two commands define traffic classes for QoS policies but differ in their match logic: class-map match-all requires all conditions to be satisfied (logical AND), while class-map match-any requires at least one condition (logical OR). They are commonly confused because they are syntactically similar yet produce different classification behavior.

Aspect	class-map match-all [name]	class-map match-any [name]
Match Logic	All conditions must match (AND)	Any condition matches (OR)
Default (if omitted)	match-all is default	Requires explicit keyword
Typical Use Case	Strict traffic filtering (e.g., VoIP with DSCP EF and RTP)	Loose traffic grouping (e.g., HTTP or DNS or SMTP)
Flexibility	Less flexible; all criteria must be met	More flexible; any criterion triggers match
Number of Match Statements	Often fewer due to strict logic	Can include many match statements

Use class-map match-all [name] when you need to ensure traffic meets a specific combination of attributes, such as a particular DSCP value AND a specific access group.

Use class-map match-any [name] when you want to classify traffic from multiple sources or types into one class, such as matching either HTTP, HTTPS, or DNS traffic.

Platform Notes

In IOS-XE, the `class-map match-all` command syntax is identical to classic IOS. However, IOS-XE supports additional match criteria such as `match application` for NBAR2-based classification. The output of `show class-map` may include additional fields like 'match-all' or 'match-any' explicitly.

In NX-OS, the equivalent command is `class-map type qos match-all [name]` (note the 'type qos' keyword). NX-OS also requires specifying the type (qos, queuing, etc.) and uses a different configuration mode. For example: `class-map type qos match-all VOIP` then `match dscp 46`.

The policy-map syntax also differs. On ASA firewalls, class-maps are used for QoS and inspection, but the command is `class-map [name]` without the match-all keyword; instead, match criteria are defined under the class-map using `match` commands, and the default is match-all. ASA does not support match-any; to achieve OR logic, you must create multiple class-maps and nest them.

In IOS-XR, the command is `class-map match-all [name]` similar to IOS, but the configuration is done under a different hierarchy (e.g., under a policy-map). IOS-XR also supports hierarchical class-maps. For IOS versions, the command has been available since at least 12.0 and remains consistent in 15.x and 16.x.

However, older versions may not support certain match criteria like `match protocol`; use access-lists instead. Always check the specific IOS version documentation for supported match options.

Related Commands

class-map match-any [name]

Creates a class map that matches traffic if any one of the specified match criteria is true, used to classify traffic for QoS policies.

policy-map [name]

Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.

service-policy

Attaches a QoS policy map to an interface in the input or output direction, activating traffic classification, marking, queuing, policing, and shaping defined in the policy map.

show class-map

Displays the configuration and match criteria of all class maps or a specific class map, used to verify QoS classification rules.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions