Cisco ASA VPN QoS

[vttendere]

Hi

Does the ASA copy the ToS byte from the original packet into the newly created IP header of an encrypted packet (VPN)? I'd appreciate a pointer to a Cisco doc that has the details.

Thanks

[andrew.prince]

Have  a look at the below config example:-

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008080dfa7.shtml

HTH>

[Panos Kampanakis]

Along with the link that Andrew sent I would like to add that the ASA maintains and copies the ToS field

.

And provide one more link to help you do QoS on the ASA https://supportforums.cisco.com/docs/DOC-1230

I hope it helps.

PK

[vttendere]

Hi

Thanks for your response. I had actually configured QoS on the ASA, however when I was sniffing traffic after the ASA I noticed that the traffic traversing the VPN (ESP packets) had DSCP DEFAULT markings, so I was a bit concerned about the preservation of the TOS information. I thought that maybe there is an extra command I need to put, I cant see this in the doc you sent me though.

Thanks guys

[Panos Kampanakis · Accepted solution]

On the ASA the TOS bits in the original IP header are copied to the IP header of the encrypted packet so that QoS policies can be enforced after encryption.

It is done by default with no extra commands needed as on the routers.

Please check if your incoming packet have the DSCP bits set if you see that there are no DSCP on the outside.

PK

[vttendere]

Hi

Indeed traffic coming into the ASA was not marked correctly.

Thanks a lot for your assistance.

[Panos Kampanakis]

I am glwe could  out.

Take care,

PK