Cisco Cisco ISA550 Integrated Security Appliance Leaflet
Application Note
© 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.
Page 16 of 17
Configuring QoS on Your Wireless Network
On a busy wireless network, you need to ensure that important and time-sensitive traffic is prioritized.
Enabling Wireless QoS
Use the Networking > QoS > General Settings page to enable QoS features on your wireless network. The Wireless
QoS pages are unavailable until this setting is enabled.
If the wireless QoS is disabled, then traffic is managed according to the Wi-Fi Multimedia (WMM) standard. Wi-Fi
Multimedia is enabled by default on the Wireless > Basic Setting page.
Choosing How to Classify Wireless Traffic
You can use DSCP or CoS values to classify wireless traffic on each SSID. DSCP is the default classification
method. To change this setting, use the Networking > QoS > Wireless QoS > Classification Methods page.
Classifying and Prioritizing Wireless Traffic
Use the Wireless QoS pages to classify and prioritize wireless traffic. The procedures are the same as those for LAN
QoS.
Ensuring QoS with VPN Traffic
The ISA supports QoS Pre-classify for IPSec VPN, and this feature is always enabled. The ISA will copy the DSCP
value from the original IP header before encryption to the IP header. If the other device is QoS aware, it can classify
the IPSec traffic according to the copied DSCP values.
Troubleshooting
If I add two overlapping class rules to a WAN QoS Priority Profile, which one will take priority?
The relative priority of the class rules is determined by the order in which they appear in the policy profile. The class
rules that are lower in the list have precedence over the rules that are higher in the list.
Which WAN QoS priority queue will be used for general traffic by default?
Q6, the lowest queues is be used by default.
Can I limit the rate for multicast traffic?
Yes. You can set the destination address to multicast IP address to filter the traffic, then bind it to the WAN interface
inbound direction.
Can I use QoS to limit the rate of DMZ server and port forwarding traffic?
Yes. For example, let’s say that you set up a DMZ to allow Internet users to access an FTP server on your DMZ. You
can configure your outbound QoS profile to limit the rate of FTP traffic so that users’ downloads do not consume all of
your bandwidth. When you set up the Traffic Selector, set the Source Address to the private IP address of the server.
Likewise, you can configure an inbound policy profile to limit the bandwidth consumed by uploads from Internet users
to your FTP server. In traffic selector for this class rule, set the Destination Address to the private IP address of the
server.
Sometimes, after I modified the QoS setting, it doesn’t take effect immediately.
When you apply a new QoS setting, it won’t apply to traffic that is already queued or in the process of being
transferred. If you want to stop all traffic and immediately enforce the new QoS setting, you can use the Firewall >
Session Limits page to disconnect all the sessions.