QoS on IPSec VPN Tunnel for VOice Traffic - Help Needed

[aseychell]

Hi,

I have two sites one with a 1811 and the other with an 831. Both sites have an internet connection and there is a VPN Tunnel between them.

I want to implement QoS on the Tunnel interface as I want to prioritize voice traffic through the Tunnel. There is a Linksys VoIP system running through the tunnel.

Signaling Packets are marked with 7 Hex and RTP packets b0.

I am not very confident with QoS configuration so I used SDM to create the policy maps and classes for me, giving 70% bandwidth for voice. I then used the qos pre-classify command on the tunnel interface. Connectivity to the internet is through a Dialer Interface so the service policy is applied to this interface. Note that I cannot apply the policy directly on the tunnel interface as it does not support header compression.

I am attaching a partial config of what I have. Can someone please point out if my config is right or not and how can I check if it is working as it should be?

Thanks alot.

[paolo bevilacqua]

Hello,

1st, check with ISP that they actually do apply QoS on their network. If they don't, any effoert on your side is wasted.

2nd, since your routers do not face the circuits directly, you must shape before applying QoS. See:

http://cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a00800b2d29.shtml

3rd: 7 Hex and b0 ??? Should be af41 and ef.

[aseychell]

I want to enable QoS as I tried to disable all other traffic except the voice on the tunnel and voice quality was fine, so I would presume that the ISP supports QoS.

The bits I was mentioning are Diffserv Bits. Do I need to make use of these?

Also I tried to configure my class maps with the parent / child policy-map hierarchy but when I tried to put it on the fastethernet inteface connected to the DSL modem, I had an error stating that it does not support Ip Header compression. Do I need to put the "service-policy output" command on the Dialer, on the Fast Ethernet or on the Tunnel interface?

Also I noticed that the 831 does not have a match protocol sip or rtp commands. I created and ACL which caps traffic from the VoIP Pabx to the VoIP gateway and used the match access-group . I think this will still work no, as all the traffic matching the ACL is all VoIP.

Thanks again for your help