Guidelines and limitations for service policies

Service policies apply to routed or switch interfaces only, in either routed or transparent mode. They do not apply to inline set or passive interfaces.

You can configure up to 25 traffic classes for an interface or the global policy.

• Global policy: You can configure up to 25 service policy rules for a given security zone or interface group.

• Interface-based rules: The limit applies to the interfaces themselves, not to each zone or interface group. Because an interface can belong to both a security zone and an interface group, the number of rules allowed for a zone or group might be lower than 25, depending on its member interfaces.

You can have at most one rule for a given interface object/traffic flow combination.

When you make service policy changes to the configuration, all new connections use the new service policy. Existing connections continue to use the policy that was configured at the time of the connection establishment. If you want all connections to immediately use the new policy, you need to disconnect the current connections so they can reconnect using the new policy. Use an SSH or Console CLI session to enter the clear conn or clear local-host commands.

QoS rules and service policy rules (in the access control policy) are translated to commands on the firewall. This includes creating policy maps. There can be only one policy map per interface. The system automatically combines QoS and service policy configurations in a single policy map per interface.

However, you can also create policy maps manually using FlexConfig. For lower-end firewalls, such as the Secure Firewall 3100, you can create up to 64 policy maps in the configuration. For more powerful firewalls, such as the Firepower 4100, you can create up to 128. Be careful not to exceed this limit, or deployment will fail. You can view the device configuration from the CLI or use the deployment transcript to see how rules are translated to commands.