QoS for IPSEC(port 500,4500)

[z.elguesmi]

hello,

please  you have any idea how can I configure QoS in the router CISCO1841 for  the port IPSEC(UDP 500 ,UDP 4500) and the port tcp 4433

thx for your help

[Simon Brooks]

Create an acl matching the port numbers. Create class map matching the acl. The create your policy map defining what you want do with it I.e. police/prioritise etc then apply to interface. That what you're after?


Sent from Cisco Technical Support Android App

[z.elguesmi]

I did that :

###############################################

class-map match-all test

match protocol ipsec

policy-map qostest

class test

  bandwidth 1536

interface FastEthernet0/1

ip address X.X.X.X 255.255.255.252

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

service-policy output qostest

############################################

its looks good ?

and how I can test if that work or no

thx

[Simon Brooks]

Show policy-map int fa0/1

Look for hits in the class.

Matching a protocol? Have you got nbar turned on?

Sent from Cisco Technical Support Android App

[z.elguesmi]

I did show policy-map int fa0/1 and I had this :

############ when i did not use the VPN ###########################

1841#show policy-map interface fastEthernet0/1

FastEthernet0/1

  Service-policy output: qostest

    Class-map: test (match-all)

      11083 packets, 1580794 bytes

      5 minute offered rate 0 bps, drop rate 0 bps

      Match: protocol ipsec

      Queueing

        Output Queue: Conversation 265

        Bandwidth 1536 (kbps)Max Threshold 64 (packets)

        (pkts matched/bytes matched) 2/236

        (depth/total drops/no-buffer drops) 0/0/0

    Class-map: class-default (match-any)

      10542255 packets, 1927566731 bytes

      5 minute offered rate 12000 bps, drop rate 0 bps

      Match: any

###############################################################

###############  when i use the vpn ##############################

1841#show policy-map interface fastEthernet0/1

FastEthernet0/1

  Service-policy output: qostest

    Class-map: test (match-all)

      11096 packets, 1583464 bytes

      5 minute offered rate 2000 bps, drop rate 0 bps

      Match: protocol ipsec

      Queueing

        Output Queue: Conversation 265

        Bandwidth 1536 (kbps)Max Threshold 64 (packets)

        (pkts matched/bytes matched) 2/236

        (depth/total drops/no-buffer drops) 0/0/0

    Class-map: class-default (match-any)

      10542690 packets, 1927611628 bytes

      5 minute offered rate 6000 bps, drop rate 0 bps

      Match: any

################################################################

for your question : " Matching a protocol? Have you got nbar turned on? "

I did not understand

[Simon Brooks]

So it is working then? I think matching a protocol turns on nbar anyway so don't worry about that.

Sent from Cisco Technical Support Android App