Enterprise QoS Solution Reference Network Design Guide
Enterprise QoS Solution Reference Network Design Guide
Enterprise QoS Solution Reference Network Design Guide
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Chapter 6 IPSec VPN <strong>QoS</strong> <strong>Design</strong><br />
Version 3.3<br />
Figure 6-27 Split Tunnel Example Topology<br />
Spouse-and-Child PC<br />
Cisco 837<br />
IP<br />
V3PN<br />
Teleworker<br />
Router<br />
<strong>Enterprise</strong>-Owned IP<br />
Phone and Workstation<br />
DSL<br />
Teleworker V3PN <strong>QoS</strong> Considerations<br />
The following configuration fragment provides a means to implement this policy. It assumes that the headend<br />
IPSec crypto peers reside on network 150.102.223.0/29. In this example environment, two peers are<br />
configured at 150.102.223.3 and 150.102.223.4. Packets within the IPSec tunnel—those matching the<br />
CORP-INTRANET access control list (identifying RFC 1918 private addresses that are assumed in this<br />
example to represent the intranets behind the headends)—will be encapsulated in an ESP (IPSec-IP<br />
protocol 50) IP header. A class-map CORPORATE is configured that references the CORPORATE<br />
extended access list, pointing to the VPN headend subnet.<br />
A policy map named V3PN-SPLIT-TUNNEL is created that includes classes for VOICE,<br />
INTERNETWORK-CONTROL, and CALL-SIGNALING, along with a bandwidth class for<br />
CORPORATE.<br />
In this example, the VOICE class is provisioned for a G.711 codec over a (384-kbps) DSL uplink,<br />
allocating 150 kbps (or 40 percent, whichever syntax is preferred) for VoIP. Example 6-8 shows the<br />
relevant configuration fragment.<br />
Example 6-8 V3PN-SPLIT-TUNNEL Policy Example<br />
150.102.223.3<br />
Broadband/Internet<br />
Service Provider<br />
IPSec<br />
Headend<br />
Router(s)<br />
150.102.223.4<br />
!<br />
crypto map SPLIT-TUNNEL-CRYPTO-MAP 1 ipsec-isakmp<br />
set peer 150.102.223.3<br />
set peer 150.102.223.4<br />
set transform-set TS<br />
match address CORP-INTRANET ! <strong>Reference</strong>s CORP-INTRANET ACL<br />
qos pre-classify ! Enables <strong>QoS</strong> Pre-Classify<br />
!<br />
!<br />
class-map match-all VOICE<br />
match ip dscp ef ! VoIP<br />
class-map match-any INTERNETWORK-CONTROL<br />
match ip dscp cs6 ! IP Routing<br />
match access-group name IKE ! <strong>Reference</strong>s ISAKMP ACL<br />
class-map match-any CALL-SIGNALING<br />
match ip dscp cs3 ! New Call-Signaling<br />
match ip dscp af31 ! Old Call-Signaling<br />
class-map match-all CORPORATE<br />
match access-group name CORPORATE ! <strong>Reference</strong>s CORPORATE ACL<br />
!<br />
policy-map V3PN-SPLIT-TUNNEL<br />
class VOICE<br />
priority 150 ! Encrypted G.711 over DSL (PPPoE/AAL5)<br />
class INTERNETWORK-CONTROL<br />
bandwidth percent 5 ! Control Plane provisioning<br />
class CALL-SIGNALING<br />
bandwidth percent 5 ! Call-Signaling provisioning<br />
class CORPORATE<br />
bandwidth percent 25 ! "Work-related" traffic provisioning<br />
<strong>Enterprise</strong> <strong>QoS</strong> <strong>Solution</strong> <strong>Reference</strong> <strong>Network</strong> <strong>Design</strong> <strong>Guide</strong><br />
6-37
Change language