Enterprise QoS Solution Reference Network Design Guide

Chapter 6 IPSec VPN QoS Design
Summary
Version 3.3
Example 6-10 Integrated Unit + Access Model—Cable Design Example
!
class-map match-all VOICE
match ip dscp ef ! VoIP
class-map match-any INTERNETWORK-CONTROL
match ip dscp cs6 ! IP Routing
match access-group name IKE ! References ISAKMP ACL
class-map match-any CALL-SIGNALING
match ip dscp cs3 ! Old Call-Signaling
match ip dscp af31 ! New Call-Signaling
!
!
policy-map V3PN-TELEWORKER
class VOICE
priority 128 ! Encrypted G.711 over Cable
class INTERNETWORK-CONTROL
bandwidth percent 5 ! Control Plane provisioning
class CALL-SIGNALING
bandwidth percent 5 ! Call-Signaling provisioning
class class-default
fair-queue
queue-limit 30 ! Optional: Anti-Replay Tuning
!
!
policy-map SHAPE-384-CABLE
class class-default
shape average 364800 3640 ! Shapes to 95% of 384 kbps cable link
service-policy V3PN-TELEWORKER ! Nested V3PN Teleworker queuing policy
!
...
!
interface Ethernet0
description Inside Ethernet Interface
ip tcp adjust-mss 542 ! TCP MSS value tuned for slow-link
!
interface Ethernet1
description Outside Ethernet Interface
ip address dhcp
ip tcp adjust-mss 542 ! TCP MSS value tuned for slow-link
service-policy output SHAPE-384-CABLE ! Shaper applied to LAN interface
!
Verification commands:
show policy
show policy interface
Enterprise QoS Solution Reference Network Design Guide
Summary
IPSec VPNs, the most commonly deployed VPN solutions today, are found in three main contexts:
site-to-site VPNs, teleworker VPNs, and remote-access VPNs. The overlaying of QoS technologies on
top of IPSec VPNs is dubbed V3PN, for voice- and video-enabled Virtual Private Networks. This chapter
presented considerations and design recommendations for V3PN deployments in site-to-site and
teleworker contexts. A summary of the design recommendations for encryption and QoS for site-to-site
and teleworker IPSec V3PNs is illustrated in Figure 6-30.
6-41