Courseiva
QoSGlobal Config

class-map match-any [name]

Creates a class map that matches traffic if any one of the specified match criteria is true, used to classify traffic for QoS policies.

Definition: class-map match-any [name] is a Cisco IOS global config command. Creates a class map that matches traffic if any one of the specified match criteria is true, used to classify traffic for QoS policies.

Overview

The `class-map match-any [name]` command is a fundamental building block for Quality of Service (QoS) configuration on Cisco IOS devices. It creates a class map that defines a traffic class based on one or more match criteria, where the traffic is considered a match if any one of the criteria is true (logical OR). This command is essential for classifying network traffic into distinct categories, such as voice, video, or data, which can then be subjected to different QoS policies like marking, policing, shaping, or queuing.

The concept behind class maps is rooted in the need to differentiate traffic types in modern networks, where applications have varying performance requirements. For example, voice traffic requires low latency and jitter, while bulk data transfers can tolerate delays. By using `class-map match-any`, network engineers can create flexible classification rules that capture multiple traffic types under a single class, simplifying policy application.

This command is typically used in conjunction with a policy map (`policy-map`) that defines the actions to be taken on the classified traffic. The broader workflow involves first creating class maps to identify traffic, then creating a policy map to specify actions, and finally applying the policy map to an interface using the `service-policy` command. The `match-any` variant is particularly useful when you want to include multiple match statements (e.g., match access-group, match protocol, match dscp) and have the class match if any condition is met.

In contrast, `match-all` requires all conditions to be true. The choice between `match-any` and `match-all` depends on the classification logic needed. For instance, if you want to classify traffic that is either from a specific subnet or has a specific DSCP value, `match-any` is appropriate.

The command operates in global configuration mode and does not require special privileges beyond standard enable access. It directly modifies the running configuration, and changes take effect immediately when the policy map is applied. A common mistake is forgetting to enter the class-map configuration mode after issuing the command, which leads to syntax errors.

Also, class maps are local to the device and not automatically propagated; they must be configured on each device where QoS is applied. Understanding this command is critical for CCNA and CCNP candidates as QoS is a core topic in both certifications, and class maps are the foundation of modular QoS CLI (MQC).

Syntax·Global Config
class-map match-any [name]

When to Use This Command

  • Classify multiple types of traffic (e.g., HTTP, FTP) into a single class for bandwidth allocation
  • Mark traffic from different source subnets with the same DSCP value
  • Apply policing to a mix of voice and video traffic that share a common ACL
  • Combine different match criteria (e.g., protocol and port) to identify application traffic

Parameters

ParameterSyntaxDescription
nameWORDThe name of the class map. This is a user-defined alphanumeric string (no spaces) that identifies the traffic class. Valid values are any string up to 40 characters. Common mistakes include using spaces or special characters, or using a name that conflicts with an existing class map.

Command Examples

Creating a class map to match HTTP or FTP traffic

class-map match-any WEB_AND_FTP
Router(config-cmap)# match protocol http
Router(config-cmap)# match protocol ftp
Router(config-cmap)# exit

The class-map command enters class-map configuration mode. The 'match-any' keyword means traffic matching any one of the subsequent match statements will be classified. Here, HTTP or FTP traffic will match. The 'exit' command returns to global config.

Creating a class map with multiple ACLs

class-map match-any CRITICAL_APPS
Router(config-cmap)# match access-group name VOICE_ACL
Router(config-cmap)# match access-group name VIDEO_ACL
Router(config-cmap)# end

This class map matches traffic that matches either the VOICE_ACL or the VIDEO_ACL. The 'end' command exits to privileged EXEC mode. The class map is now ready to be used in a policy map.

Understanding the Output

The class-map command itself does not produce output; it enters a configuration submode. The output shown is the CLI prompt changes. After configuration, use 'show class-map' to verify.

The output of 'show class-map' lists all class maps, their match type (match-all or match-any), and the match criteria. For a class-map match-any, any single match criterion being true makes the traffic belong to that class. In a real network, you would then apply the class map in a policy map to perform QoS actions like marking, policing, or queuing.

Configuration Scenarios

Classify Voice and Video Traffic for Priority Queuing

A network administrator needs to ensure that voice and video traffic from specific IP phones and video conferencing systems receive priority treatment over other traffic. The goal is to create a class map that matches either RTP audio traffic (UDP ports 16384-32767) or traffic with DSCP EF (46) or AF41 (34).

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)SW1 R1(Gi0/1)---10.0.0.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create a class map named VOICE-VIDEO with match-any logic: class-map match-any VOICE-VIDEO
  3. 3.Step 3: Match RTP audio traffic using a named access list: match access-group name RTP
  4. 4.Step 4: Match DSCP EF: match dscp ef
  5. 5.Step 5: Match DSCP AF41: match dscp af41
  6. 6.Step 6: Exit class-map configuration: exit
  7. 7.Step 7: Create a policy map to apply priority queuing: policy-map QOS-POLICY
  8. 8.Step 8: Specify the class: class VOICE-VIDEO
  9. 9.Step 9: Set priority bandwidth: priority percent 30
  10. 10.Step 10: Exit policy-map and apply to interface: interface GigabitEthernet0/0, service-policy output QOS-POLICY
Configuration
!
ip access-list extended RTP
 permit udp any any range 16384 32767
!
class-map match-any VOICE-VIDEO
 match access-group name RTP
 match dscp ef
 match dscp af41
!
policy-map QOS-POLICY
 class VOICE-VIDEO
  priority percent 30
!
interface GigabitEthernet0/0
 service-policy output QOS-POLICY
!

Verify: Use 'show class-map' to verify the class map exists and its match criteria. Use 'show policy-map interface GigabitEthernet0/0' to see traffic statistics for the class. Expected output includes packet counts for the VOICE-VIDEO class.

Watch out: A common mistake is forgetting to create the access list before referencing it in the class map, which results in an error. Also, ensure the access list name matches exactly.

Classify Web Traffic for Bandwidth Limiting

An organization wants to limit bandwidth for HTTP and HTTPS traffic to prevent it from consuming too much link capacity. The class map should match traffic destined to TCP ports 80 and 443, using match-any so that either port triggers classification.

Topology

R1(Gi0/0)---192.168.2.0/24---(Gi0/0)SW2 R1(Gi0/1)---10.0.1.0/30---(Gi0/0)R3

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create a class map named WEB-TRAFFIC: class-map match-any WEB-TRAFFIC
  3. 3.Step 3: Match HTTP traffic: match protocol http
  4. 4.Step 4: Match HTTPS traffic: match protocol secure-http
  5. 5.Step 5: Exit class-map configuration: exit
  6. 6.Step 6: Create a policy map to shape traffic: policy-map SHAPE-WEB
  7. 7.Step 7: Specify the class: class WEB-TRAFFIC
  8. 8.Step 8: Set bandwidth limit: police cir 10000000 bc 15000 be 15000 conform-action transmit exceed-action drop
  9. 9.Step 9: Exit and apply to interface: interface GigabitEthernet0/1, service-policy input SHAPE-WEB
Configuration
!
class-map match-any WEB-TRAFFIC
 match protocol http
 match protocol secure-http
!
policy-map SHAPE-WEB
 class WEB-TRAFFIC
  police cir 10000000 bc 15000 be 15000
   conform-action transmit
   exceed-action drop
!
interface GigabitEthernet0/1
 service-policy input SHAPE-WEB
!

Verify: Use 'show class-map' to confirm the class map. Use 'show policy-map interface GigabitEthernet0/1' to see policing statistics. Expected output shows conformed and exceeded packets for the WEB-TRAFFIC class.

Watch out: A common mistake is using 'match protocol http' without enabling NBAR (Network-Based Application Recognition) globally. Ensure 'ip nbar protocol-discovery' is enabled on the interface or globally. Also, the protocol names may vary by IOS version (e.g., 'secure-http' vs 'https').

Troubleshooting with This Command

When troubleshooting class-map configurations, the primary tool is the 'show class-map' command, which displays all configured class maps and their match criteria. A healthy output shows the class map name, match type (match-any or match-all), and the list of match statements. Problem indicators include missing match statements, incorrect match types, or class maps that are not referenced in any policy map.

If a class map is not matching traffic as expected, first verify that the match criteria are correctly defined. For example, if using 'match access-group', ensure the access list exists and contains the correct permit statements. Use 'show access-lists' to verify.

If using 'match protocol', confirm that NBAR is enabled and that the protocol is recognized by the device. Use 'show ip nbar protocol-discovery' to see if traffic is being classified. Another common issue is that the class map may be matching too broadly or too narrowly.

For instance, using 'match any' will match all traffic, which might not be intended. To diagnose, use 'show policy-map interface [interface]' to see the traffic statistics for each class. If the packet count for a class is zero, the traffic is not being classified into that class.

Check the order of class maps in the policy map; the first matching class wins. Also, ensure the policy map is applied in the correct direction (input or output). For match-any class maps, if multiple match statements are present, the traffic matches if any condition is true.

If you suspect a match statement is not working, test it individually by creating a temporary class map with only that match statement. Additionally, use debug commands like 'debug policy-map' or 'debug class-map' (if available) to see real-time classification decisions. However, use debug cautiously in production.

Correlate class-map output with 'show ip interface' to verify that the service policy is applied. Finally, remember that class maps are local to the device; if traffic is not matching, consider whether the traffic is actually traversing the interface where the policy is applied. A step-by-step diagnostic flow: 1) Verify the class map exists with 'show class-map'. 2) Verify the policy map exists and references the class with 'show policy-map'. 3) Verify the policy is applied to the correct interface and direction with 'show running-config interface [interface]'. 4) Check traffic statistics with 'show policy-map interface [interface]'. 5) If no matches, check individual match criteria with appropriate show commands (access-lists, NBAR, etc.). 6) Use ping or traffic generator to test specific traffic types. 7) If still not matching, consider using 'match any' temporarily to confirm the policy is working, then narrow down.

CCNA Exam Tips

1.

Remember: 'match-any' is OR logic; 'match-all' is AND logic. Exam questions often test the difference.

2.

You can match on protocols, ACLs, DSCP values, CoS, etc. Know which match types are available.

3.

Class maps are useless without being referenced in a policy map. The exam may ask you to identify missing steps.

4.

The class-map name is case-sensitive and must be unique on the device.

Common Mistakes

Using 'match-all' when 'match-any' is needed, causing traffic that meets only one criterion to not be classified.

Forgetting to exit class-map configuration mode before creating the policy map.

Typing the class-map name incorrectly, leading to a mismatch when applying in a policy map.

class-map match-any [name] vs policy-map [name]

The class-map match-any and policy-map commands are both essential for QoS policy configuration on Cisco IOS routers, but they serve distinct roles. They are often confused because they are used together: class-map defines traffic classes (match criteria), while policy-map applies actions (like bandwidth or priority) to those classes. Understanding their differences is critical for correct QoS deployment.

Aspectclass-map match-any [name]policy-map [name]
ScopeDefines a traffic class based on match criteria (any condition true)Defines a policy that binds classes to QoS actions
Configuration modeGlobal configurationGlobal configuration
PersistenceSaved in running-config and startup-configSaved in running-config and startup-config
PrecedenceUsed as a building block; must be referenced by a policy-mapReferences class-maps and is applied to an interface via service-policy
Typical useClassifying traffic (e.g., match ACL, DSCP, CoS)Enforcing QoS actions (e.g., priority, bandwidth, drop)

Use class-map match-any [name] when you need to define a set of match criteria where any one match classifies the traffic for further QoS treatment.

Use policy-map [name] when you want to assign QoS actions (such as bandwidth allocation, priority queuing, or policing) to one or more traffic classes defined by class-maps.

Platform Notes

On Cisco IOS-XE, the `class-map match-any` command syntax is identical to classic IOS. However, IOS-XE may support additional match criteria such as 'match application' for NBAR2. The output of 'show class-map' is similar but may include application IDs.

On NX-OS (Cisco Nexus switches), the equivalent command is `class-map type qos match-any [name]`. The 'type qos' is required, and the match criteria syntax differs slightly; for example, 'match access-group' uses 'match access-group [name]' without the 'name' keyword. NX-OS also uses 'match dscp' similarly.

On ASA (Adaptive Security Appliance), class maps are used in modular policy framework (MPF) with the command `class-map [name]` and then `match any` or `match access-list`, but the syntax is different: `class-map [name]` enters class-map configuration mode, and match statements are like `match any` or `match access-list [acl-name]`. The ASA does not support 'match-any' explicitly; all match statements within a class map are ORed by default. On IOS-XR, the equivalent is `class-map match-any [name]` but with different match options; for example, 'match dscp' is supported, but 'match protocol' may require additional configuration.

IOS-XR also uses a different configuration hierarchy. Regarding IOS versions, the command has been available since at least IOS 12.0. In 12.x, match criteria were limited; in 15.x, NBAR and deeper inspection were added.

In 16.x (IOS-XE), the command remains largely unchanged but benefits from enhanced NBAR. Always check the specific IOS version documentation for exact syntax and capabilities.

Related Commands

class-map match-all [name]

Creates a class map that matches packets based on multiple match criteria, requiring all conditions to be true (logical AND) for traffic classification in QoS policies.

policy-map [name]

Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.

show class-map

Displays the configuration and match criteria of all class maps or a specific class map, used to verify QoS classification rules.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions