I thought it was possible in an access list?
Source Destination Service Action TimeRange Log Expired Queue TOS 8021P Blacklist Mirror DisScan ClassifyMedia IPv4/6
any <network> 255.255.255.0 svc-https permit High 26 6 4
any any any permit Low 4
I've done captures on the controller and indeed any traffic leaving it and going to that destination does have the Qos tag added.
:smileyhappy: