IPSec/GRE QoS

[ahmede1]

By default, IPsec/GRE will preserve the dscp/precedence marking of the data packet in the encapsulating header

Now for our design, we want to IPsec/GRE header marking to be different from the original IP packet marking. The IPsec/GRE header marking will be based on the original IP packet marking, so we need to read the IP packet marking and then based on this marking we will mark the IPsec/GRE header with different DSCP without changing the original IP packet DSCP..

Can that be done? How?

Thank you for your help

[Francesco Molino · Accepted solution]

Hi

To apply a qos setting on the traffic going through your tunnel, you would need to use qos pre-classify.
Here a documentation that explains it well:
https://www.google.ca/amp/s/cisconinja.wordpress.com/2008/11/29/qos-pre-classify-in-gre-over-ipsec-vpns/amp/

[Joseph W. Doherty · Accepted solution]

It can be done, but unsure it can done on the same device that has the tunnel end-point (although I suspect it can).

It might be as simple as having a policy on the physical egress for the tunnel that examines the current packet's ToS marking (i.e. the IPSec/GRE packet's ToS) and then just remarks.