Downloads |
Configuration Guide
Configuring CBWFQ for IPSec VPN
Figure 1
Network Diagram
Introduction
This document describes how to configure Quality of Service (QoS) for traffic between a Hub router (Cisco 7200 Series Router) and a spoke router (Cisco 3745 Router). The QoS policy is enabled on the public interface, and it examines the traffic before being encrypted. The policy is configured using the Modular Quality of Service Command Line Interface (MQC).
Prerequisites
The sample QoS configuration is based on the following assumptions:
Components Used
The sample configuration uses the following releases of the software and hardware:
Figure 1 illustrates the network for the sample configuration.
The information presented in this document was created from devices in a specific lab environment. All of the devices started with a cleared (default) configuration. If you are working in a live network, it is imperative to understand the potential impact of any command before implementing it.
QoS Configuration Options
The sample configuration minimizes bandwidth guarantees and maximizes bandwidth policing. Additional QoS features that can be used in the policy map include low latency queuing, traffic shaping, and random early detection.
In the sample configuration, the class-map matches the original unencrypted packets. To match the unencrypted packet, you use the qos-preclassify command as documented in the QoS for Virtual Private Networks . The matching for the traffic is made with the ACL. Any of the unencrypted packet information specified in the ACL can be used for matching a specific class and applying a different service policy to different classes for the outbound traffic.
The service policy can be applied on the input or on the output of the public or private interface of both routers. The sample configuration shows the service policy applied to output traffic on the hub and the spoke router.
For additional information about configuring QoS, refer to Cisco IOS Quality of Service Solutions Configuration Guide.
Cisco 7200 VPN Router Configuration
Configuring the Cisco 3745 VPN Router
Verifying the Results
This section provides information you can use to confirm that your configuration is working properly.
Bandwidth 200 (kbps) Max Threshold 64 (packets)
c3745-20#show policy-map interface fastEthernet 0/1
4605058 packets, 2567115168 bytes
30 second offered rate 9550000 bps, drop rate 0 bps
3884074 packets, 2141735456 bytes
Output Queue: Conversation 265
Bandwidth 200 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 2044996/1186842912
(depth/total drops/no-buffer drops) 0/0/0
cir 5000000 bps, bc 156250 bytes
conformed 2230228 packets, 1237348128 bytes; actions:
exceeded 2374831 packets, 1329767552 bytes; actions:
conformed 4999000 bps, exceed 4550000 bps,
Class-map: class-default (match-any)
532380 packets, 313976237 bytes
30 second offered rate 0 bps, drop rate 0 bps
permit ip 10.0.149.0 0.0.0.255 10.0.50.0 0.0.0.255 (4227393 matches)
permit ip 10.0.149.0 0.0.0.255 10.0.50.0 0.0.0.255 (3887076 matches)
Troubleshooting the Configuration
Certain show commands are supported by the Output Interpreter Tool (registered customers only), which analyzes show command output.
Note: Before issuing debug commands, see Important Information about Debug Commands .
- debug crypto isakmp—Displays errors during Phase 1.
- debug crypto ipsec—Displays errors during Phase 2.
- debug crypto engine—Displays information from the crypto engine.
- debug ip your routing protocol—Displays information about routing transactions of your routing protocol.
- clear crypto connection connection-id [slot | rsm | vip]—Terminates an encrypted session currently in progress. Encrypted sessions normally terminate when the session times out. Use the show crypto cisco connections command to see the connection-id value.
- clear crypto isakmp—Clears the Phase 1 security associations.
- clear crypto sa—Clears the Phase 2 security associations.
Related Information
An Introduction to IP Security (IPsec) Encryption
QoS for Virtual Private Networks
Configuring IPsec Network Security
Configuring Internet Key Exchange Security Protocol
Command Lookup Tool (registered customers only)
Technical Support - Cisco Systems