Enterprise QoS Solution Reference Network Design Guide

References
References
Standards
6-42
Figure 6-30 IPSec V3PN Site-to-Site and Teleworker Design Summary Comparison
IPSec/GRE
LLQ/CBWFQ/LFI
HDLC MLP ATM
Site-to-Site
WAN Media
Encryption
Frame
Relay
QoS
Enterprise QoS Solution Reference Network Design Guide
IPSec Only
Hierarchical Shaping +
Queuing + TCP MSS
Ethernet DSL Cable
Broadband Media
Teleworker
Chapter 6 IPSec VPN QoS Design
Some site-to-site considerations that were discussed include the bandwidth implications of various
IPSec modes of operations and the incompatibility of cRTP and IPSec. The interrelation of IPSec VPN
logical hub-and-spoke topologies and the effect these have on spoke-to-spoke delay budgets also were
examined. Subsequently, the ToS byte preservation mechanism was overviewed along with the QoS
Pre-Classify Cisco IOS Software feature, which allows for the classification of packets already
encrypted (on the same router) through ACLs. QoS and Anti-Replay implications then were discussed,
illustrating how QoS policies that reorder packets potentially can exacerbate Anti-Replay drops (an
IPSec message-integrity mechanism). Techniques for minimizing such undesired QoS/Anti-Reply interaction
effects, such as reducing the queue length of data queues, were presented. Next, the need for control plane
provisioning was highlighted, along with basic designs for doing so.
Several site-to-site QoS models were detailed, ranging from a six-class V3PN QoS model to a complex
11-class V3PN QoS Baseline model. WAN aggregator considerations specific to IPSec VPN
deployments were examined next, including QoS provisioning for IPSec over private WANs, per-tunnel
hierarchical shaping and queuing, and recommendations for decoupled VPN headend/WAN aggregation
deployment models, where encryption and QoS are performed on different routers.
Attention then shifted to teleworker scenarios and the three main teleworker deployment models: the
Integrated Unit Model, the Dual-Unit Model, and the Integrated Unit + Access Model. The two main
broadband media types, DSL and cable, were broken down to ascertain the bandwidth-provisioning
implications of each media. Neither DSL nor (DOCSIS 1.0) cable includes any mechanism for
serialization delay mitigation, so TCP maximum segment-size tuning was considered as an alternative
mechanism to achieve this. Split-tunneling designs, to address spouse-and-child requirements, were
introduced.
Teleworker V3PN designs then were detailed for Integrated Unit and Dual-Unit models over DSL, in
addition to an Integrated Unit + Access Model solution for cable.
RFC 1321, “The MD5 Message-Digest Algorithm”: http://www.ietf.org/rfc/rfc1321.txt.
RFC 1918, “Address Allocation for Private Internets”: http://www.ietf.org/rfc/rfc1918.txt.
RFC 2104, “HMAC: Keyed-Hashing for Message Authentication”:
http://www.ietf.org/rfc/rfc2104.txt.
Version 3.3