Courseiva
QoSClass-map Config

match protocol [http|ftp|voip]

Matches packets based on the application protocol (HTTP, FTP, or VoIP) in a class map for QoS classification.

Definition: match protocol [http|ftp|voip] is a Cisco IOS class-map config command. Matches packets based on the application protocol (HTTP, FTP, or VoIP) in a class map for QoS classification.

Overview

The 'match protocol' command in class-map configuration mode is a fundamental tool for Quality of Service (QoS) classification on Cisco IOS devices. It allows a network engineer to identify traffic based on the application protocol—specifically HTTP, FTP, or VoIP—so that the router can apply different QoS policies (e.g., marking, policing, shaping, queuing) to that traffic. This command is essential for implementing application-aware QoS, where different types of traffic receive different treatment based on their importance or sensitivity to delay, jitter, and packet loss.

For example, VoIP traffic is typically prioritized over HTTP or FTP traffic because voice requires low latency and jitter, while file transfers can tolerate delays. The command operates within a class map, which is a named classification filter used in policy maps. When you configure 'match protocol http', the router inspects packets using Network-Based Application Recognition (NBAR) to identify HTTP traffic by examining port numbers (TCP 80) and optionally deeper packet inspection.

This is more flexible than matching only on access lists because NBAR can recognize protocols even if they use non-standard ports. You would reach for this command when you need to classify traffic by application rather than by IP address or port alone, such as in a network where HTTP traffic might be on port 8080 or where you want to differentiate between HTTP and HTTPS. Alternatives include using access lists to match specific ports (e.g., permit tcp any any eq 80) or using 'match protocol' with other NBAR-supported protocols.

The command fits into the broader QoS workflow: first, classify traffic with class maps; second, create a policy map that applies actions (e.g., set dscp, police, shape) to each class; third, apply the policy map to an interface. Important IOS behavior: the 'match protocol' command requires the NBAR module to be enabled (via 'ip nbar protocol-discovery' or 'ip nbar custom' for custom protocols). The command is available in privileged EXEC mode (config-class-map).

It affects the running configuration immediately. Buffered output is not directly relevant, but the command's success depends on NBAR being supported on the platform and IOS version. Privilege level 15 is required to enter class-map configuration.

The command does not appear in the running config until you exit class-map mode. Understanding this command is critical for CCNA and CCNP candidates because QoS is a core topic, and application classification is a key skill for modern networks that carry voice, video, and data.

Syntax·Class-map Config
match protocol [http|ftp|voip]

When to Use This Command

  • Prioritizing HTTP traffic for web servers in a data center.
  • Shaping FTP traffic to prevent bandwidth saturation during large file transfers.
  • Applying strict priority queuing to VoIP traffic for low latency.
  • Classifying and marking traffic for different service levels in an enterprise network.

Parameters

ParameterSyntaxDescription
protocolhttp | ftp | voipSpecifies the application protocol to match. Valid values are 'http' (Hypertext Transfer Protocol, typically TCP port 80), 'ftp' (File Transfer Protocol, TCP ports 20 and 21), and 'voip' (Voice over IP, which includes protocols like SIP, RTP, and RTCP). Common mistakes include misspelling the protocol name or using 'voice' instead of 'voip'. Note that 'voip' is a meta-protocol that matches multiple VoIP-related protocols; for more granular control, use specific protocol names like 'rtp' or 'sip' if supported.

Command Examples

Match HTTP traffic

match protocol http

This command matches all HTTP (port 80) traffic. No output is generated; it is used within a class-map configuration.

Match FTP traffic

match protocol ftp

Matches FTP control and data traffic (ports 20 and 21). No output.

Match VoIP traffic

match protocol voip

Matches VoIP signaling and media streams (e.g., SIP, RTP). No output.

Understanding the Output

The 'match protocol' command does not produce output on its own. It is used within class-map configuration mode to define a match criterion. Verification is done via 'show class-map' which displays the configured match statements.

In 'show class-map', look for the 'Match protocol' line under the class map name. A correctly configured class map will show the protocol listed. If the protocol is misspelled or unsupported, the command will be rejected with an error.

Configuration Scenarios

Classify HTTP traffic for bandwidth limitation

A company wants to limit HTTP traffic to 10 Mbps to ensure that critical business applications get sufficient bandwidth. The network has a single router connecting the LAN to the WAN.

Topology

LAN---(Gi0/1)R1(Gi0/0)---WAN

Steps

  1. 1.Step 1: Enter global configuration mode: R1# configure terminal
  2. 2.Step 2: Create a class map named HTTP-TRAFFIC: R1(config)# class-map match-any HTTP-TRAFFIC
  3. 3.Step 3: Match HTTP protocol: R1(config-cmap)# match protocol http
  4. 4.Step 4: Exit class-map mode: R1(config-cmap)# exit
  5. 5.Step 5: Create a policy map named LIMIT-HTTP: R1(config)# policy-map LIMIT-HTTP
  6. 6.Step 6: Specify the class: R1(config-pmap)# class HTTP-TRAFFIC
  7. 7.Step 7: Police the traffic to 10 Mbps: R1(config-pmap-c)# police 10000000 1000000 exceed-action drop
  8. 8.Step 8: Exit policy-map mode: R1(config-pmap-c)# exit
  9. 9.Step 9: Apply the policy map to the WAN interface: R1(config)# interface gigabitethernet 0/0
  10. 10.Step 10: Apply service policy: R1(config-if)# service-policy output LIMIT-HTTP
Configuration
! Full IOS config block
class-map match-any HTTP-TRAFFIC
 match protocol http
!
policy-map LIMIT-HTTP
 class HTTP-TRAFFIC
  police 10000000 1000000 exceed-action drop
!
interface GigabitEthernet0/0
 service-policy output LIMIT-HTTP

Verify: Use 'show policy-map interface gigabitethernet 0/0' to verify the policy is applied and see packet counts. Expected output shows class HTTP-TRAFFIC with policer statistics.

Watch out: Ensure NBAR is enabled globally with 'ip nbar protocol-discovery' on the interface, otherwise 'match protocol http' may not classify traffic correctly.

Prioritize VoIP traffic over FTP

A branch office uses VoIP phones and also transfers large files via FTP. The network engineer wants to ensure VoIP packets are prioritized to avoid voice quality issues.

Topology

Phones---(Gi0/1)R1(Gi0/0)---WAN FTP Server---(Gi0/2)R1

Steps

  1. 1.Step 1: Enter global configuration mode: R1# configure terminal
  2. 2.Step 2: Create class map for VoIP: R1(config)# class-map match-any VOIP
  3. 3.Step 3: Match VoIP protocol: R1(config-cmap)# match protocol voip
  4. 4.Step 4: Exit class-map mode: R1(config-cmap)# exit
  5. 5.Step 5: Create class map for FTP: R1(config)# class-map match-any FTP
  6. 6.Step 6: Match FTP protocol: R1(config-cmap)# match protocol ftp
  7. 7.Step 7: Exit class-map mode: R1(config-cmap)# exit
  8. 8.Step 8: Create policy map: R1(config)# policy-map QOS-POLICY
  9. 9.Step 9: Set VoIP class to priority queue: R1(config-pmap)# class VOIP
  10. 10.Step 10: Set priority bandwidth: R1(config-pmap-c)# priority 1000
  11. 11.Step 11: Set FTP class to fair-queue: R1(config-pmap)# class FTP
  12. 12.Step 12: Set bandwidth: R1(config-pmap-c)# bandwidth 5000
  13. 13.Step 13: Exit and apply to WAN interface: R1(config-pmap-c)# exit, R1(config-pmap)# exit, R1(config)# interface gigabitethernet 0/0, R1(config-if)# service-policy output QOS-POLICY
Configuration
! Full IOS config block
class-map match-any VOIP
 match protocol voip
!
class-map match-any FTP
 match protocol ftp
!
policy-map QOS-POLICY
 class VOIP
  priority 1000
 class FTP
  bandwidth 5000
!
interface GigabitEthernet0/0
 service-policy output QOS-POLICY

Verify: Use 'show policy-map interface gigabitethernet 0/0' to see the priority queue for VoIP and bandwidth allocation for FTP. Also use 'show class-map' to verify class maps.

Watch out: The 'priority' command is only available for classes that are not the default class. Also, ensure that the interface has enough bandwidth to support the priority queue; otherwise, packets may be dropped.

Troubleshooting with This Command

When troubleshooting QoS classification with the 'match protocol' command, the first step is to verify that NBAR is functioning correctly. Use 'show ip nbar protocol-discovery' on the interface to see if NBAR is classifying traffic. Healthy output shows protocol statistics with packet counts for HTTP, FTP, VoIP, etc. If the output shows zero packets for a protocol that should be present, NBAR may not be enabled or the traffic may not be recognized.

Another key command is 'show class-map', which displays the configured class maps and their match criteria. Ensure the class map includes the 'match protocol' statement. Use 'show policy-map interface [interface]' to see if the policy map is applied and if packets are being matched.

Look for the class name and check the 'Matched packets' counter. If the counter is zero, the classification is not working. Common symptoms include: VoIP traffic being dropped or experiencing jitter, which may indicate that the VoIP class is not matching.

In such cases, verify that the 'match protocol voip' command is correct and that the router supports NBAR for VoIP (some older platforms may not). Another symptom is HTTP traffic not being limited, which could mean the HTTP class is not matching. Check if the traffic uses a non-standard port; NBAR may not recognize it.

Use 'show ip nbar port-map http' to see which ports NBAR associates with HTTP. If the traffic uses a different port, you may need to use a custom NBAR definition or an access list. A step-by-step diagnostic flow: 1) Check if NBAR is enabled globally and on the interface ('ip nbar protocol-discovery' on the interface). 2) Verify class-map configuration with 'show class-map'. 3) Verify policy-map configuration with 'show policy-map'. 4) Check interface service policy with 'show policy-map interface'. 5) Generate test traffic and observe counters. 6) If counters remain zero, use 'debug ip nbar' (with caution) to see if NBAR is inspecting packets.

Correlate with 'show access-lists' if using ACLs for classification. Also, check the router's CPU utilization; NBAR can be CPU-intensive. If the router is overloaded, classification may fail.

Finally, ensure the IOS version supports NBAR for the specific protocols; some older versions may not support 'match protocol voip'.

CCNA Exam Tips

1.

Remember that 'match protocol' uses NBAR (Network-Based Application Recognition) to identify applications; it is not just port-based.

2.

CCNA exam may test that 'match protocol http' matches HTTP traffic regardless of port if NBAR is enabled.

3.

Know that 'match protocol voip' matches common VoIP protocols like SIP, H.323, and RTP.

4.

Be aware that 'match protocol' is only available in class-map configuration mode under 'class-map type qos'.

Common Mistakes

Using 'match protocol' in a class-map that is not type qos (e.g., class-map type traffic).

Misspelling the protocol name (e.g., 'http' vs 'https' or 'ftp' vs 'ftp-data').

Forgetting that 'match protocol' requires NBAR to be enabled globally with 'ip nbar protocol-discovery'.

match protocol [http|ftp|voip] vs policy-map [name]

Both 'match protocol [http|ftp|voip]' and 'policy-map [name]' are fundamental to Cisco's Modular QoS CLI (MQC). They are often confused because they are used together in a QoS policy: class-maps define traffic classification, while policy-maps apply actions. Understanding their distinct roles is critical for designing effective QoS policies.

Aspectmatch protocol [http|ftp|voip]policy-map [name]
ScopeWithin a class-map definitionCreates or modifies a policy-map with one or more class-maps
Configuration modeClass-map configuration modeGlobal configuration mode
FunctionMatches packets by application protocolDefines service policies (e.g., bandwidth, priority) for traffic classes
Relationship to each otherUsed inside a class-map that is then referenced by a policy-mapReferences one or more class-maps (which may use match protocol) and applies QoS actions
PersistenceSaved as part of the class-map configurationSaved as part of the policy-map configuration, independently of class-maps
Typical useClassifying VoIP or HTTP traffic for QoSApplying guaranteed bandwidth or priority to classified traffic

Use match protocol [http|ftp|voip] when you need to classify packets based on application protocol within a QoS class-map.

Use policy-map [name] when you need to associate QoS actions (like shaping, policing, priority) with traffic classes defined by class-maps.

Platform Notes

In IOS-XE, the 'match protocol' command syntax is identical to classic IOS, but NBAR is typically enabled by default on supported platforms. However, the output of 'show policy-map interface' may differ slightly in formatting. For NX-OS, the equivalent command is 'match protocol' under class-map configuration, but the syntax for NBAR is different; NX-OS uses 'ip nbar' commands and the 'match protocol' command is available in QoS class-map mode.

For example, on Nexus switches, you would use 'class-map type qos match-any HTTP' and then 'match protocol http'. The NX-OS equivalent of NBAR is called 'NBAR' as well, but configuration is via 'ip nbar protocol-discovery' under interface. On ASA firewalls, QoS classification is done using Modular Policy Framework (MPF) with 'class-map' and 'match' commands, but the 'match protocol' command is not used; instead, you match on access lists or specific criteria like 'match port tcp eq 80'.

For IOS-XR, the command is 'match protocol' under class-map configuration, but the syntax is similar to classic IOS. However, IOS-XR uses a different QoS infrastructure (MQC) and NBAR is not supported in all versions; instead, you may use 'match dscp' or 'match precedence'. Differences between IOS versions: In IOS 12.x, NBAR was introduced and 'match protocol' supported a limited set of protocols.

In 15.x, more protocols were added, including 'voip'. In 16.x (IOS-XE), NBAR2 is used, which supports a much larger protocol database. The command behavior is consistent, but the available protocol names may vary.

Always check the 'match protocol ?' output for the list of supported protocols on your specific IOS version. On some platforms, 'match protocol voip' may not be available; you may need to match individual protocols like 'sip', 'rtp', 'rtcp' instead. Also, note that 'match protocol' is only supported on interfaces that are not in the default VRF on some platforms.

Related Commands

policy-map [name]

Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.

show class-map

Displays the configuration and match criteria of all class maps or a specific class map, used to verify QoS classification rules.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions