Enterprise QoS Solution Reference Network Design Guide

Teleworker V3PN QoS Considerations
Dual-Unit Model
6-28
Enterprise QoS Solution Reference Network Design Guide
Chapter 6 IPSec VPN QoS Design
Note The Cisco routers used in these scenarios require an IP/FW/PLUS 3DES Cisco IOS Software feature set.
This feature set would include support for LLQ/CBWFQ with class-based hierarchical traffic shaping,
and also support for Easy VPN (EZVPN), PKI, IDS, AES, URL filtering, and EIGRP.
Integrated Unit + Access Model
Advantages include the following:
Single-device deployment and management
Adaptability for service provider fully managed services (transport, QoS, IP Telephony application)
Potential cost savings
Disadvantages include the following:
Availability of a single device at an appropriate cost with the features and performance required
No single unit for some broadband access circuit types
The Integrated Model is a preferred model for service providers offering a fully managed V3PN
teleworker service.
From a QoS design perspective, this model is highly similar to a site-to-site V3PN, except that it
interfaces with a broadband media instead of a traditional WAN access media.
In this model, one device (such as a Cisco 831, 837, or 1700-series router) provides basic services and
QoS, and a second device (a Cisco router or a PIX 501 or even a VPN 3002) performs security/VPN
services.
Advantages include the following:
Granularity of managed services—Service providers can manage broadband access while
enterprises manage VPN/security and private network addressing because these are two different
units.
Media independence—Because the VPN/security device is separate from the router connecting to
the broadband circuit, the same VPN device can be used for cable, DSL, wireless, and ISDN by
changing the router model or module in the router. This is especially valuable if one enterprise must
support teleworkers with different broadband circuit types (such as DSL, cable, and ISDN).
Disadvantages include the following:
Two units packaged for deployment
Ongoing management of two devices
The cost for two devices
From a QoS design perspective, this model is no different from the previous (Integrated Unit) model.
In this third model, a single router (such as a Cisco 831 or 1700-series router) provides basic services,
QoS services, and VPN/security services. However, the router does not connect directly to the broadband
access media; it connects (through Ethernet) to a broadband access device (such as a DSL or cable
modem).
Advantages include the following:
Cost savings realized by using existing broadband-access devices
Version 3.3