Enterprise QoS Solution Reference Network Design Guide

Version 3.3
IPSec VPN QoS Design
CHAPTER
Enterprise QoS Solution Reference Network Design Guide
6
IPSec VPNs are the most widely deployed VPNs and are found in three main contexts:
Site-to-site IPSec VPNs
Teleworker IPSec VPNs
Remote-access client (mobility) IPSec VPNs
QoS considerations for site-to-site and teleworker IPSec VPNs are examined in this design chapter (as
QoS is rarely—if ever—deployed in remote-access client IPSec VPN scenarios). These considerations
include the following:
IPSec modes of operation
Bandwidth and delay increases because of encryption
IPSec and cRTP incompatibility
IP ToS byte preservation through IPSec encryption
QoS and Anti-Replay interaction implications
Following a discussion of these considerations, design recommendations for site-to-site and teleworker
(DSL and cable) solutions are presented in detail.
Whereas MPLS technologies provide VPN services, such as network segregation and privacy, by
maintaining independent virtual router forwarding tables, IPSec achieves such VPN services through
encryption.
As defined in RFCs 2401 through 2412, IPSec protocols provide mechanisms to enable remote sites to
cost effectively connect to enterprise intranets or extranets using the Internet (or a service provider’s
shared IP networks). Because of IPSec protocol encryption, such VPNs can provide the same
management and security policies as private networks.
IPSec VPN services are built by overlaying a point-to-point mesh over the Internet using Layer
3–encrypted tunnels. This architecture requires security appliances, such as (hardware or software)
firewalls or routers that support IPSec tunnels, to be installed at both ends of each tunnel.
Encryption/decryption is performed at these tunnel endpoints, and the protected traffic is carried across
the shared network.
Three main design contexts for IPSec VPNs exist, as shown in Figure 6-1:
Site-to-site VPNs—Tunnels are maintained by hardware devices to connect multiple users at remote
branches to (one or more) central sites.
Teleworker VPNs—Tunnels are maintained by hardware devices to connect (typically) a single
user at his or her residence to a central site.
6-1