topic Cisco ASA VPN QoS in Network Security

Cisco ASA VPN QoS

vttendere — Mon, 11 Mar 2019 16:43:42 GMT

Does the ASA copy the ToS byte from the original packet into the newly created IP header of an encrypted packet (VPN)? I'd appreciate a pointer to a Cisco doc that has the details.

Thanks

Re: Cisco ASA VPN QoS

andrew.prince — Mon, 30 Nov 2009 13:33:07 GMT

Have a look at the below config example:-

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008080dfa7.shtml

HTH>

Re: Cisco ASA VPN QoS

Panos Kampanakis — Mon, 30 Nov 2009 23:11:45 GMT

Along with the link that Andrew sent I would like to add that the ASA maintains and copies the ToS field

And provide one more link to help you do QoS on the ASA https://supportforums.cisco.com/docs/DOC-1230

I hope it helps.

Re: Cisco ASA VPN QoS

vttendere — Tue, 01 Dec 2009 08:10:36 GMT

Thanks for your response. I had actually configured QoS on the ASA, however when I was sniffing traffic after the ASA I noticed that the traffic traversing the VPN (ESP packets) had DSCP DEFAULT markings, so I was a bit concerned about the preservation of the TOS information. I thought that maybe there is an extra command I need to put, I cant see this in the doc you sent me though.

Thanks guys

Re: Cisco ASA VPN QoS

Panos Kampanakis — Tue, 01 Dec 2009 14:46:42 GMT

On the ASA the TOS bits in the original IP header are copied to the IP header of the encrypted packet so that QoS policies can be enforced after encryption.

It is done by default with no extra commands needed as on the routers.

Please check if your incoming packet have the DSCP bits set if you see that there are no DSCP on the outside.

Re: Cisco ASA VPN QoS

vttendere — Wed, 02 Dec 2009 10:56:05 GMT

Indeed traffic coming into the ASA was not marked correctly.

Thanks a lot for your assistance.

Re: Cisco ASA VPN QoS

Panos Kampanakis — Wed, 02 Dec 2009 15:00:56 GMT

I am glwe could out.

Take care,