class [class-map-name]
The class command in policy-map configuration mode associates a traffic class (defined via class-map) with a set of QoS actions (like policing, shaping, or marking) within a service policy.
Definition: class [class-map-name] is a Cisco IOS policy-map config command. The class command in policy-map configuration mode associates a traffic class (defined via class-map) with a set of QoS actions (like policing, shaping, or marking) within a service policy.
Overview
The `class` command in policy-map configuration mode is a fundamental building block for implementing Quality of Service (QoS) policies on Cisco IOS devices. It allows a network engineer to associate a previously defined class-map (which identifies a specific traffic class based on criteria such as DSCP, IP precedence, ACL, or protocol) with a set of QoS actions within a service policy. This command is essential for applying differentiated treatment to network traffic, enabling functions like traffic policing, shaping, marking, queueing, and bandwidth allocation. Without the `class` command, a policy-map would be an empty shell; it is the mechanism that ties classification to action.
The underlying networking concept is Class-Based QoS, where traffic is grouped into classes, and each class receives a specific forwarding treatment. This approach is critical in modern networks where voice, video, and data traffic compete for bandwidth. The `class` command is used within a policy-map, which is then applied to an interface (inbound or outbound) via the `service-policy` command. It is the go-to command when you need to enforce QoS policies beyond simple interface-level commands like `priority` or `bandwidth` (which are limited). Alternatives include using Modular QoS CLI (MQC) with a flat policy-map without classes, but that is less flexible. The `class` command fits into the broader workflow: first, define class-maps to match traffic; second, create a policy-map and use `class` to specify actions for each class; third, apply the policy-map to an interface. It is also used in troubleshooting to verify which classes are matching traffic and whether actions are being applied correctly.
Important IOS behaviors: The `class` command is available in policy-map configuration mode, which is entered via `policy-map [policy-map-name]`. It requires privileged EXEC mode (enable) to configure. The command is processed immediately and affects the running configuration; changes take effect when the policy-map is applied to an interface. There is no buffered output; the command is executed line by line. The privilege level required is 15 (enable). The command supports both IPv4 and IPv6 traffic, but class-maps must be configured accordingly. A common mistake is forgetting to create the class-map before referencing it in the policy-map, which results in an error. Also, the order of classes matters: the first matching class wins, so more specific classes should be listed first. The `class` command can be used multiple times within a policy-map to define multiple classes, and a default class (class-default) is automatically available for traffic that does not match any explicit class. Understanding these nuances is crucial for CCNA and CCNP candidates to design effective QoS policies.
class [class-map-name]When to Use This Command
- Apply bandwidth guarantees to voice traffic while limiting web traffic in a WAN link.
- Mark VoIP packets with DSCP EF and police FTP traffic to 10 Mbps.
- Shape all traffic from a specific VLAN to 50 Mbps using a parent policy.
- Drop traffic exceeding a rate limit for a specific application class.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| class-map-name | WORD (class-map name) | The name of a previously defined class-map that identifies the traffic to which the QoS actions will be applied. The class-map must exist in the running configuration; otherwise, the command will be rejected. Common mistakes include misspelling the class-map name or referencing a class-map that was defined in a different context (e.g., for a different type of traffic). The class-map can be based on match criteria such as access-group, protocol, DSCP, IP precedence, or CoS. |
Command Examples
Basic class configuration with bandwidth and police
policy-map QOS_POLICY
class VOICE
priority 1000
police 1000000 20000 40000 conform-action transmit exceed-action drop
class WEB
bandwidth 2000
random-detect dscp-based
class class-default
fair-queueRouter(config)# policy-map QOS_POLICY Router(config-pmap)# class VOICE Router(config-pmap-c)# priority 1000 Router(config-pmap-c)# police 1000000 20000 40000 conform-action transmit exceed-action drop Router(config-pmap-c)# exit Router(config-pmap)# class WEB Router(config-pmap-c)# bandwidth 2000 Router(config-pmap-c)# random-detect dscp-based Router(config-pmap-c)# exit Router(config-pmap)# class class-default Router(config-pmap-c)# fair-queue Router(config-pmap-c)# end
The 'class VOICE' enters the class configuration for the VOICE class-map. 'priority 1000' reserves 1000 kbps with strict priority. 'police' sets a policer at 1 Mbps with burst parameters. 'class WEB' enters the WEB class, 'bandwidth 2000' guarantees 2000 kbps, 'random-detect dscp-based' enables WRED. 'class class-default' configures the default class with fair-queue.
Using class with match-all and match-any in a policy
policy-map SHAPE_PARENT
class class-default
shape average 10000000
service-policy CHILD_POLICYRouter(config)# policy-map SHAPE_PARENT Router(config-pmap)# class class-default Router(config-pmap-c)# shape average 10000000 Router(config-pmap-c)# service-policy CHILD_POLICY Router(config-pmap-c)# end
This example shows a parent policy that shapes all traffic to 10 Mbps and then applies a child policy (CHILD_POLICY) for finer classification. The 'class class-default' matches all traffic not matched by other classes.
Understanding the Output
The class command itself does not produce output; it enters a subconfiguration mode. The relevant output appears when you use 'show policy-map' or 'show policy-map interface'. In 'show policy-map interface', each class is listed with counters for packets, bytes, and actions (e.g., dropped, marked).
Key fields: 'Class' shows the class-map name; 'Matched' shows packets/bytes matching; 'Actions' show what was applied (e.g., priority, bandwidth, police). Good values: low drop counts for priority classes, high match counts for expected traffic. Bad values: excessive drops in a class indicate congestion or misconfiguration.
Watch for 'conform/exceed' actions in police output to see if traffic is within limits.
Configuration Scenarios
Marking VoIP traffic with DSCP EF and policing data traffic
A network administrator needs to prioritize voice traffic (RTP) by marking it with DSCP EF (46) and police excess data traffic to prevent congestion. The policy will be applied on the WAN interface of a branch router.
Topology
Branch-Router(Gi0/0)---10.0.1.0/30---(Gi0/0)WAN-RouterSteps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Create a class-map to match voice traffic (RTP uses UDP ports 16384-32767): class-map match-any VOICE
- 3.Step 3: Define match criteria: match ip dscp ef
- 4.Step 4: Create a class-map to match data traffic: class-map match-any DATA
- 5.Step 5: Define match criteria: match ip dscp af11
- 6.Step 6: Create a policy-map: policy-map QOS_POLICY
- 7.Step 7: Associate the VOICE class and set DSCP: class VOICE; set ip dscp ef
- 8.Step 8: Associate the DATA class and police: class DATA; police 1000000 20000 20000 conform-action transmit exceed-action drop
- 9.Step 9: Apply the policy-map outbound on the WAN interface: interface GigabitEthernet0/0; service-policy output QOS_POLICY
! Full IOS config block class-map match-any VOICE match ip dscp ef ! class-map match-any DATA match ip dscp af11 ! policy-map QOS_POLICY class VOICE set ip dscp ef class DATA police 1000000 20000 20000 conform-action transmit exceed-action drop ! interface GigabitEthernet0/0 service-policy output QOS_POLICY
Verify: Use 'show policy-map interface GigabitEthernet0/0' to verify the policy is applied and see packet counts for each class. Expected output shows 'VOICE' class with 'set dscp ef' and 'DATA' class with policing statistics.
Watch out: Ensure the class-map names are exactly as referenced in the policy-map. A common mistake is using 'match ip dscp' without specifying the DSCP value correctly (e.g., 'ef' vs '46'). Also, the police command requires careful tuning of burst parameters; incorrect values can cause excessive drops.
Shaping traffic for a specific application using NBAR
An enterprise wants to limit bandwidth for YouTube traffic (classified via NBAR) to 5 Mbps on a branch office router to ensure business-critical applications get sufficient bandwidth.
Topology
Branch-Router(Gi0/0)---192.168.1.0/24---(Gi0/0)Core-RouterSteps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Create a class-map to match YouTube traffic using NBAR: class-map match-any YOUTUBE
- 3.Step 3: Define match protocol: match protocol http host *.youtube.com
- 4.Step 4: Create a policy-map: policy-map SHAPE_POLICY
- 5.Step 5: Associate the YOUTUBE class and apply shaping: class YOUTUBE; shape average 5000000
- 6.Step 6: Apply the policy-map outbound on the interface: interface GigabitEthernet0/0; service-policy output SHAPE_POLICY
! Full IOS config block class-map match-any YOUTUBE match protocol http host *.youtube.com ! policy-map SHAPE_POLICY class YOUTUBE shape average 5000000 ! interface GigabitEthernet0/0 service-policy output SHAPE_POLICY
Verify: Use 'show policy-map interface GigabitEthernet0/0' to verify shaping is active. Look for 'shape average 5000000' under the YOUTUBE class and monitor the offered rate vs shaped rate.
Watch out: NBAR requires the 'ip nbar protocol-discovery' command to be enabled on the interface for classification to work. Also, the match protocol statement may need to be tuned for different YouTube domains; using a regex or hostname wildcard is common. Shaping is only effective on outbound policies.
Troubleshooting with This Command
When troubleshooting QoS policies involving the `class` command, the primary verification tool is `show policy-map interface [interface-name]`. This command displays the policy applied to an interface, including per-class statistics such as packets matched, actions taken (e.g., set, police, shape), and any drops. A healthy output shows non-zero packet counts for classes that should be matching traffic, and the actions (like 'set dscp ef' or 'police') should be listed. Problem indicators include zero packet counts for a class that should be matching, which suggests the class-map criteria are incorrect or the traffic is not hitting the interface. Another issue is excessive drops under a police or shape action, indicating the configured rate is too low or burst parameters are misconfigured.
Specific fields to focus on: 'Class' name, 'Matched' packets, 'Actions' (e.g., 'set dscp ef', 'police', 'shape'), and 'Drop' packets. For policing, look at 'conform', 'exceed', and 'violate' counters. For shaping, look at 'queued' packets and 'delayed' packets. Common symptoms: Voice quality issues may be due to missing DSCP marking; check the 'set' action is applied. Bandwidth hogs may indicate a class is not matching or policing is not dropping excess traffic.
Step-by-step diagnostic flow: 1) Verify the policy-map is applied to the correct interface and direction using `show running-config interface [interface]` or `show policy-map interface`. 2) Check class-map match criteria with `show class-map [class-map-name]` to ensure the match statements are correct. 3) Use `show access-lists` if the class-map uses ACLs. 4) For NBAR, use `show ip nbar protocol-discovery interface [interface]` to see if the protocol is being recognized. 5) If packets are not matching, consider using `debug policy-map` (with caution) to see real-time classification. 6) Correlate with `show interface` for overall interface statistics and `show queueing` for queue depths.
Correlation with other commands: `show class-map` helps verify classification criteria; `show policy-map` shows the policy definition; `show running-config | section policy-map` shows the full configuration. For policing, `show policy-map interface [interface]` provides detailed counters. For shaping, `show traffic-shape` (legacy) or `show policy-map interface` can be used. Always ensure the policy-map is applied in the correct direction (input vs output) as some actions (like shaping) are only supported outbound.
CCNA Exam Tips
CCNA exam tip: The 'class' command is used only inside a policy-map; you must first create a class-map with 'class-map'.
CCNA exam tip: 'class class-default' is always present and matches all traffic not matched by other classes; you cannot delete it.
CCNA exam tip: In a policy-map, you can use 'class' multiple times, but each class-map name must be unique.
CCNA exam tip: The order of classes matters; traffic is matched against classes in the order they are configured.
Common Mistakes
Mistake 1: Forgetting to create the class-map before referencing it in a policy-map, causing an error.
Mistake 2: Using 'class' with a class-map that has no match statements, resulting in no traffic being matched.
Mistake 3: Applying conflicting actions (e.g., both 'priority' and 'bandwidth' in the same class) which is not allowed.
class [class-map-name] vs policy-map [name]
The 'class' and 'policy-map' commands are both used in Cisco IOS QoS configuration, but at different levels: 'policy-map' defines the entire policy container, while 'class' specifies actions for a traffic class within that policy. They are often confused because both are required to build a complete QoS service policy, yet their roles and configuration modes differ significantly.
| Aspect | class [class-map-name] | policy-map [name] |
|---|---|---|
| Scope | Defines actions for a single traffic class within a policy | Defines the entire policy map that groups multiple classes |
| Configuration mode | Policy-map configuration mode (entered after 'policy-map') | Global configuration mode |
| Relationship | Child command; one policy-map can contain multiple class statements | Parent command; must exist before class commands are used |
| Persistence | Exists only within the parent policy-map; not applied directly to interface | Must be applied to an interface using 'service-policy' to take effect |
| Typical actions | Associates bandwidth, police, shape, set, or priority with a class | May include class-default or arbitrary named classes |
| Typical use | To assign QoS actions to traffic matching a specific class-map | To create a collection of class-based QoS policies for application to an interface |
Use class [class-map-name] when you need to specify QoS actions (e.g., bandwidth, police, shape) for a particular traffic class within an existing policy-map.
Use policy-map [name] when you need to create or modify a QoS policy that groups multiple class-maps with associated actions, which can then be applied to an interface via the service-policy command.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `class` command syntax is identical to classic IOS, but there are differences in output formatting and additional features like hierarchical QoS (HQoS). For example, `show policy-map interface` output may include more detailed queueing statistics. On NX-OS (e.g., Nexus switches), the equivalent command is `class [class-map-name]` within a policy-map, but the configuration mode is entered via `policy-map [type qos] [name]`.
NX-OS also uses `set qos-group` instead of `set ip dscp` for marking. The class-map definition uses `match` commands similar to IOS. For ASA firewalls, QoS is more limited; the `class` command is used within a `policy-map` for features like policing and priority queueing, but the syntax is `class [class-map-name]` and the policy-map is applied via `service-policy`.
ASA does not support shaping or complex marking. In IOS-XR (e.g., ASR 9000), the `class` command is used within a policy-map, but the configuration is hierarchical and uses `class type qos [class-map-name]`. The syntax is different: `policy-map [name]` then `class type qos [class-name]`.
Also, IOS-XR uses `set dscp` and `police` commands similarly. For older IOS versions (12.x), the `class` command behaves the same, but some features like NBAR may not be available. In 15.x and 16.x, additional match criteria (e.g., `match protocol`) are supported.
Always check the specific platform documentation for exact syntax and feature support.
Related Commands
policy-map [name]
Creates or modifies a QoS policy-map that defines a set of class-maps and associated actions (e.g., bandwidth, priority, drop) to apply to traffic on Cisco IOS routers.
show policy-map
Displays the configuration and statistics of all policy maps applied to interfaces, used to verify QoS policies and monitor traffic class counters.
show policy-map interface
Displays the current QoS policy applied to an interface, including per-class statistics such as packets matched, bytes, and actions taken, used to verify and troubleshoot QoS configurations.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions