Enterprise QoS Solution Reference Network Design Guide

Site-to-Site V3PN QoS Considerations
Pre-Encryption Queuing
6-14
Figure 6-10 QoS Pre-Classify Feature Operation
Packet
Input Interface
Crypto Engine
clone
particle1
particle2
particleN
Enterprise QoS Solution Reference Network Design Guide
A clone of the original packet headers
is created and associated with the
encrypted particles.
%$#*&1
%$#*& 2
%$#*& N
clone
class-map NET-MGMT
match access-group 123
Output Interface
!
access-list 123 permit tcp any host 10.45.15.1 eq telnet
QoS Pre-Classify allows for advanced classification (beyond ToS byte values)
such as source/dest IP addrs, Layer 4 protocols, and source/dest port numbers.
Encrypted Packet
Chapter 6 IPSec VPN QoS Design
QoS classification is performed
against the clone (as the original
packet’s headers are encrypted).
A key point to remember regarding QoS Pre-Classify is that it is applicable only at the encrypting
router’s output interface. The fields preserved by QoS Pre-Classify are not available to any routers
downstream; the clone never leaves the router performing the encryption, thus ensuring the integrity and
security of the IPSec VPN tunnel.
QoS Pre-Classify is supported in all Cisco IOS switching paths and is recommended to be enabled on
some platforms even when only the ToS byte values are being used for classification. Testing has shown
that when hardware-based encryption cards are combined with QoS, the Cisco IOS Software
implementation of the QoS Pre-Classify feature slightly enhances performance, even when matching
only on ToS byte values. Furthermore, enabling QoS Pre-Classify by default eliminates the possibility
that its configuration will be overlooked if the QoS policy later is changed to include matching on IP
addresses, ports, or protocols.
Design recommendations for the QoS Pre-Classify feature can be summarized as follows:
Enable QoS Pre-Classify on all branch IPSec VPN routers that support the feature.
Enable QoS Pre-Classify on headend IPSec VPN routers only when both the VPN termination and
QoS policies reside on the same device.
The hardware crypto engine within a Cisco VPN router’s chassis can be viewed as an internal interface
that processes packets for encryption or decryption.
Before Cisco IOS Release 12.2(13)T, packets to be encrypted were handed off to the crypto engine in a
first-in-first-out (FIFO) basis. No distinction was made between voice packets and data packets. The
FIFO queuing for crypto engines is illustrated in Figure 6-11.
Version 3.3