QoS for Virtual Private Networks (VPN)

Still discuss with QoS Classification part. When the packets cross virtual private network (VPN), that is encapsulated by encryption headers. The QoS are unable to examine and correctly classify packets. Not just the VPN are unable to examine, the tunnel is also. The VPN is actually simillar with tunnel feature.

#### Configuring with 'qos pre-classify'

#### VPN for GRE and IPIP, applied on the tunnel interface, making QoS a configuration option on a per-tunnel basis
IOS(config)# interface tunnel0 
IOS(config-if)# qos pre-classify

#### VPN for L2F and L2TP, applied on the virtual template interface, L2TP identical VPDN so QoS can be configured on a per-VPDN tunnel basis
IOS(config)# interface virtual-template1 
IOS(config-if)# qos pre-classify

#### VPN for IPSec, applied on crpto map, QoS on the interface carrying the crypto map are able to classify packets before ecryption
IOS(config)# crypto map secured-partner-1
IOS(config-crypto-map)# qos pre-classify

#### Verify QoS for VPNs

IOS# show interfaces
...
Queuing Strategy: fifo (QOS pre-classification)
...

IOS# show crypto map
...
QoS pre-classification
...

QoS Classification Overview

I want to flashback to definition of QoS Classification. Classification is important in QoS part. Classification is classify traffic or packet into specific group, categorize a packet into classes and make it accessible for QoS handling on the network. You can partition traffic into multiple priority levels (classes). The classes can perform to traffic policers, such as the traffic policing feature, the rate-limiting feature of commited access rate (CAR) and traffic shapers. And also You can use classification to mark certain packets for IP Precedence or DSCP. In Cisco IOS to look at and check traffic flow inside the router you can enable Network-Based Application Recognition (NBAR).

Several other example of traffic classification

• Policy-Based Routing
• Committed Access Rate for Cisco
• Committed Access Rate for Juniper

QoS Class-Based Packet Marking

Next discuss about Class-Based Packet Marking. To perform it, you must either configure an IP Precedence value or an IP differentiated services code point (DSCP) value.

Here is the compare values for IP precedence and Differentiated Services Code Point (DSCP).

## IP precedence=CoS ## DSCP ## Comment
## 0=routine         ## 0    ## Best effort
## 1=priority        ## 8    ##
## 2=immediate       ## 16   ##
## 3=Flash           ## 24   ##
## 4=FlashOver       ## 32   ##
## 5=critical        ## 40   ##
## 6=internet        ## 48   ##
## 7=network         ## 56   ##

#### Define class-name (class-map)

IOS(config)# class-map SSH-Class
IOS(config-cmap)# match protocol ssh

#### Define IP Precedence policy-name (policy-map)

IOS(config)# policy-map SSH-Prec-1 
IOS(config-pmap)# class SSH-Class 
IOS(config-pmap-c)# set ip precedence 1

#### Define IP DSCP policy-name (policy-map)

IOS(config)# policy-map SSH-DSCP-8 
IOS(config-pmap)# class SSH-Class 
IOS(config-pmap-c)# set ip dscp 8

#### Apply Traffic Policy to interface (service-policy)

IOS(config-if)#
service-policy input SSH-Prec-1
service-policy output SSH-DSCP-8

#### Verify Traffic Policy

IOS#show class-map
 Class Map match-any class-default (id 0)
   Match any 

 Class Map match-all SSH-Class (id 1)
   Match protocol ssh
   
IOS#show policy-map
  Policy Map SSH-Prec-1
    Class SSH-Class
      set ip precedence 1
  Policy Map SSH-DSCP-8
    Class SSH-Class
      set ip dscp cs1

IOS#show policy-map interface
 FastEthernet1/1 

  Service-policy input: SSH-Prec-1

    Class-map: SSH-Class (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: protocol ssh
      QoS Set
        precedence 1
          Packets marked 0

    Class-map: class-default (match-any)
      8 packets, 788 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any 

  Service-policy output: SSH-DSCP-8

    Class-map: SSH-Class (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: protocol ssh
      QoS Set
        dscp cs1
          Packets marked 0

    Class-map: class-default (match-any)
      3 packets, 272 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any