QoS for VPN links

omar.elmohri · ‎01-26-2009

Hello,

I have branches connected with VPN and I wanna guarantee bandwidth for that traffic using the following configuration:

!Access list to mark internal traffic

ip access-list extended QOS

permit ip any 192.168.0.0 0.0.255.255

!

!Class-map to mark internal traffic

class-map match-all QOS-IN

match access-group name QOS

!

!Class-map to match the marked traffic

class-map match-all QOS-OUT

match qos-group 1

!

!Apply to markage

policy-map QOS-IN

class QOS-IN

set qos-group 1

!

!Apply the bandwidth reservation

policy-map QOS-OUT

class QOS-OUT

bandwidth percent 50

!

!Outside

interface FastEthernet0/0

service-policy output QOS-OUT

bandwidth 512

!

!Inside

interface FastEthernet0/1

service-policy input QOS-IN

Any comments about this configuration ? because I found that there is no match for the second class-map ?

Best regards,

andrew.prince · ‎01-26-2009

You QoS config is 100% incorrect.

QoS Steps:-

1) Classify

2) Mark

3) Policing

What is the platform you are trying to perform QoS on?

omar.elmohri · ‎01-26-2009

I'm using a C2800

andrew.prince · ‎01-26-2009

Read the below links:-

http://www.cisco.com/en/US/docs/internetworking/technology/handbook/QoS.html

http://www.cisco.com/univercd/cc/td/doc/solution/esm/qossrnd.pdf

HTH>

Joseph W. Doherty · ‎01-26-2009

I had problems using qos-groups, although from its documentation what you've done, I believe, should be correct. You might also consider using the ToS instead.

Since you show the outbound policy on an Ethernet interface with a bandwidth statement of 512, your policy won't control bandwidth until there's interface congestion. You should probably shape to the actual outbound bandwidth. (Shaping appears to provide implicit FQ. Shaping alone might provide a noticable improvement.)

PS:

You're still going to have an issue for VPN bandwidth, inbound. That's very difficult to do well downstream.

omar.elmohri · ‎01-26-2009

Not that but.. I'm not seeing matches on the outside policy-map

andrew.prince · ‎01-26-2009

Read the urls I sent.

Joseph W. Doherty · ‎01-26-2009

Unclear what you're saying. If you're saying you not seeing any matches against the packets the first policy is marking, that I recall is the issue I've too seen with qos-groups, which is why I suggested using a ToS setting instead. I.e. use your inbound policy to tag with something like IP Predence 1 or DSCP CS1 and then match against that value.

omar.elmohri · ‎01-27-2009

OK, I see.

I'll will try what you suggest and I'll give a feedback.

Regards,

Omar