IPSec deployment that preserves the IP ToS information.

[mpugliese]

I wonder if there's a IPSec deployment where the IPSec header would preserve

the information contained at the byte ToS of the IP packet header, so it would be feasible confront this value against a match statement at a service-police.

[aghaznavi]

IOS IPSec implementation copies original TOS field value into the new IP header TOS field. However, PIX and VPN concentrators don't do so (just set to '0'); it means that you cannot preserve any classification settings if crossing an IPSec device wich is a PIX or a VPN concentrator (btw, both 3000 and 5000 series). IOS let you classify, apply IPSec and shape/queue.