topic Re: Applying QoS within IPSec and GRE tunnels.. in Routing and SD-WAN

Applying QoS within IPSec and GRE tunnels..

jitendraanbu — Tue, 05 Mar 2019 00:51:42 GMT

Tunnel Diagram

Hi all, I have an uncommon situation and would like Cisco’s take on it.As per the above diagram

We have a requirement where we need to classify and mark traffic on the egress (on the CE routers).

The transmission media for this traffic is PPPoE. This PPPoE transmission is via RF and get’s terminated on the ISP PE routers (as per attached figure).

Once we have L3 reachability between CE sites we build GRE tunnels from the hub site (C) to the two spokes (A & B). Over the GRE we run IPSec . Inside IPSec we enable BGP.

The question:

Our egress classification and marking is meant to be acknowledged and prioritised by the ISP, as you can see this traffic is within two tunnels - can this be done? Assuming both us & the ISP are using Cisco devices running code 12.4 or higher.

Many thnaks,

Jit

Re: Applying QoS within IPSec and GRE tunnels..

Vivek Ganapathi — Tue, 03 Jul 2012 13:24:38 GMT

Hello Jit,

Firstly, I'm not from Cisco Neither the information i have provided below is a view of Cisco.

IMHO, this is not possible. The reason is, your packet is already encrypted & gets inside the tunnel. Your ISP is just a transit path for you thats all. Not sure as to why you would like your ISP to respect your marking when you have a tunnel going on between sites? You need QoS between your sites, so you can keep your ISP apart from it.

Regards,

Vivek.

Re: Applying QoS within IPSec and GRE tunnels..

jitendraanbu — Wed, 04 Jul 2012 03:25:22 GMT

Hello there, thanks for your response. This is exactly how I feel about this as well. It is not doable, as the packets are encrypted & it's transparent to the ISP.

Rgds,

Jit

Re: Applying QoS within IPSec and GRE tunnels..

Vivek Ganapathi — Wed, 04 Jul 2012 04:08:00 GMT

Hello Jit,

Right. End-to-End QoS would be between your sites within the GRE tunnel. So, ISP wouldn't know as the QoS marking would be encapsulated as well within the GRE header.

So frankly speaking, you must not bother about the ISP's involvement to have your markings acknowledged. Remember, you are running GRE, so you would have the End-to-End QoS between your endpoints only.

Regards

Vivek

*Please rate helpful posts

Re: Applying QoS within IPSec and GRE tunnels..

jitendraanbu — Wed, 04 Jul 2012 05:57:51 GMT

Agai, I agree with you Vivek.

Disappointing no one from Cisco has commented on this.

Rgds,

Jit