Exclude traffic from crypto map based on DSCP/IP precedence values

MysticalTh0r — Fri, 21 Feb 2020 13:57:08 GMT

Hi all,

I'm trying to configure an IPsec connection which excludes some traffic from being encripted using its dscp value. Apparently it's as easy as configuring its dscp value with a deny statement on the crypto ACL , but it's not working. Sometimes it encripts the traffic and sometimes it drops it, depending on the configuration. I need to configure a "deny tcp/udp any any" at the top of the ACL since the same source network could generate some traffic to be encripted and some not to be (skype, voip, etc...).My goal is to get something like this to work:

access-list 2285 deny udp any any dscp ef
access-list 2285 deny udp any any dscp af41

access-list 2285 permit <nerwork_1> <network_2>

(...)
access-list 2285 permit <nerwork_y> <network_z>

If I use deny statements without "any any" but with "network_a network_b" it works but there are so many networks (and more to be deployed) that the "any any" are needed. I'm using a Cisco 3925 with IOS 15.4(3)M3 but I've also tested some other older IOS with the same results.

Any help/advice? Thanks, Best regards,

José Manuel.

topic Exclude traffic from crypto map based on DSCP/IP precedence values in Network Security

Exclude traffic from crypto map based on DSCP/IP precedence values