How does QOS pre-classify realy work

dominic.caron · ‎01-08-2009

Hi,

Does Qos pre-classify simply copy the precedence feild form the inside packet to the encapsulation header or does it apply the policy-map of the source physical interface?

I would say it only copy the feild but I have a GRE over IPsec tunnel mode that's behaving funny...

Nicholas Matthews · ‎01-08-2009

Hi Dominic,

Any time there is a tunneled protocol or encrypted packet, IOS will automatically copy the TOS byte (DSCP) over to the new packet.

You use pre-classify when you want to use QoS based on portions of the encrypted/tunneled packet that are no longer available (NBAR, packet length, etc).

hth,

nick

dominic.caron · ‎01-08-2009

Ok, it works like I expected.

Now for my funny router...

I've got my main campus and a remote site connected by an encrypted GRE tunnel. Where do I place de QOS pre classify command, on the tunnel interface or on the crypto-map...or on both.

I've tried configuring it on both. On the policing policy-map on the outgoing interface, my match statement is an ACL trying to match on ESP traffic (the hit counter doesnt increase) and I've added a line for the un-encrypted trafic IPs and this one has hits. In the child policy, I've got hit with my IP precedende value in my voice class, that part is ok.

So, why can't I match on my permit ESP host A host B? And how is it possible to have match on the acl (permit ip any to remote site range)? The later should be encrypted when it hit the outbound policy map.