Note
Be sure to enable all the categorization methods you want devices to use when assigning incoming traffic to various QoS classes. A network policy can reference just one classifier map.The permit and deny actions in a QoS policy enable devices to enforce a simple stateless firewall policy that inspects packets individually, instead of within the context of an ongoing session. Because a stateless firewall configured to permit outgoing requests does not associate the corresponding incoming responses, you must configure a separate policy to permit the return traffic. A stateful firewall uses an internal table to associate corresponding outgoing and incoming traffic.
Devices log traffic whether the action is permit or deny. The main reason to log traffic is to see if the devices are receiving expected or unexpected types of traffic when you debug connectivity issues. You can see these log entries in the even log using the
show logging buffered
command, or you can configure the device to send event logs to a syslog server and view them there.