The ASA supports the following QoS features:

• Policing—To prevent classified traffic from hogging the network bandwidth, you can limit the maximum bandwidth used per class. See Policing for more information.

• Priority queuing—For critical traffic that cannot tolerate latency, such as Voice over IP (VoIP), you can identify traffic for Low Latency Queuing (LLQ) so that it is always transmitted ahead of other traffic. See Priority Queuing.

A token bucket is used to manage a device that regulates the data in a flow, for example, a traffic policer. A token bucket itself has no discard or priority policy. Rather, a token bucket discards tokens and leaves to the flow the problem of managing its transmission queue if the flow overdrives the regulator.

A token bucket is a formal definition of a rate of transfer. It has three components: a burst size, an average rate, and a time interval. Although the average rate is generally represented as bits per second, any two values may be derived from the third by the relation shown as follows:

average rate = burst size / time interval

Here are some definitions of these terms:

• Average rate—Also called the committed information rate (CIR), it specifies how much data can be sent or forwarded per unit time on average.

• Burst size—Also called the Committed Burst (Bc) size, it specifies in bytes per burst how much traffic can be sent within a given unit of time to not create scheduling concerns.

• Time interval—Also called the measurement interval, it specifies the time quantum in seconds per burst.

In the token bucket metaphor, tokens are put into the bucket at a certain rate. The bucket itself has a specified capacity. If the bucket fills to capacity, newly arriving tokens are discarded. Each token is permission for the source to send a certain number of bits into the network. To send a packet, the regulator must remove from the bucket a number of tokens equal in representation to the packet size.

If not enough tokens are in the bucket to send a packet, the packet waits until the packet is discarded or marked down. If the bucket is already full of tokens, incoming tokens overflow and are not available to future packets. Thus, at any time, the largest burst a source can send into the network is roughly proportional to the size of the bucket.

Policing is a way of ensuring that no traffic exceeds the maximum rate (in bits/second) that you configure, thus ensuring that no one traffic class can take over the entire resource. When traffic exceeds the maximum rate, the ASA drops the excess traffic. Policing also sets the largest single burst of traffic allowed.

LLQ priority queuing lets you prioritize certain traffic flows (such as latency-sensitive traffic like voice and video) ahead of other traffic. Priority queuing uses an LLQ priority queue on an interface (see Configure the Priority Queue for an Interface), while all other traffic goes into the “best effort” queue. Because queues are not of infinite size, they can fill and overflow. When a queue is full, any additional packets cannot get into the queue and are dropped. This is called tail drop. To avoid having the queue fill up, you can increase the queue buffer size. You can also fine-tune the maximum number of packets allowed into the transmit queue. These options let you control the latency and robustness of the priority queuing. Packets in the LLQ queue are always transmitted before packets in the best effort queue.

You can configure each of the QoS features alone if desired for the ASA. Often, though, you configure multiple QoS features on the ASA so you can prioritize some traffic, for example, and prevent other traffic from causing bandwidth problems. You can configure:

Priority queuing (for specific traffic) + Policing (for the rest of the traffic).

You cannot configure priority queuing and policing for the same set of traffic.

DSCP (DiffServ) markings are preserved on all traffic passing through the ASA. The ASA does not locally mark/remark any classified traffic. For example, you could key off the Expedited Forwarding (EF) DSCP bits of every packet to determine if it requires “priority” handling and have the ASA direct those packets to the LLQ.

To view the QoS statistics for traffic policing, use the show service-policy police command.

hostname# show service-policy police

Global policy:
	Service-policy: global_fw_policy

Interface outside:
	Service-policy: qos
		Class-map: browse
			police Interface outside:
				cir 56000 bps, bc 10500 bytes
				conformed 10065 packets, 12621510 bytes; actions: transmit
				exceeded 499 packets, 625146 bytes; actions: drop
				conformed 5600 bps, exceed 5016 bps
		Class-map: cmap2
			police Interface outside:
				cir 200000 bps, bc 37500 bytes
				conformed 17179 packets, 20614800 bytes; actions: transmit
				exceeded 617 packets, 770718 bytes; actions: drop
				conformed 198785 bps, exceed 2303 bps

To view statistics for service policies implementing the priority command, use the show service-policy priority command.

hostname# show service-policy priority
Global policy:
	Service-policy: global_fw_policy
Interface outside:
	Service-policy: qos
		Class-map: TG1-voice
			Priority:
				Interface outside: aggregate drop 0, aggregate transmit 9383

“Aggregate drop” denotes the aggregated drop in this interface; “aggregate transmit” denotes the aggregated number of transmitted packets in this interface.

To display the priority-queue statistics for an interface, use the show priority-queue statistics command. The results show the statistics for both the best-effort (BE) queue and the low-latency queue (LLQ). The following example shows the use of the show priority-queue statistics command for the interface named test.

hostname# show priority-queue statistics test

Priority-Queue Statistics interface test

Queue Type        = BE
Packets Dropped   = 0
Packets Transmit  = 0
Packets Enqueued  = 0
Current Q Length  = 0
Max Q Length      = 0

Queue Type        = LLQ
Packets Dropped   = 0
Packets Transmit  = 0
Packets Enqueued  = 0
Current Q Length  = 0
Max Q Length      = 0
hostname#

In this statistical report:

• “Packets Dropped” denotes the overall number of packets that have been dropped in this queue.

• “Packets Transmit” denotes the overall number of packets that have been transmitted in this queue.

• “Packets Enqueued” denotes the overall number of packets that have been queued in this queue.

• “Current Q Length” denotes the current depth of this queue.

• “Max Q Length” denotes the maximum depth that ever occurred in this queue.