QoS Ingress or Egress?

[Jesse Shumaker]

I'm wondeiring if anyone can point me into the right direction for a guide on how QoS should be applied? Meaning, I want to know if it should be applied on the outgoing interface (I usually see it this way) or the incoming interface? And how should it be applied when coming into a firewall through an IPsec L2L tunnel so it gets the same priority.

thanks

[Terry Cheema]

At the bare minimum on the WAN facing router apply it to the WAN interface outbound. This will ensure traffic prioritisation over the WAN link thats the most congested part.

-Terry

Sent from Cisco Technical Support iPhone App

[Terry Cheema]

If you are planning to run ipsec on adsl/dsl generally there is no SLA guaranteed, QoS markings may not be honoured.

-Terry
Sent from Cisco Technical Support iPhone App

[Jesse Shumaker]

I think what I'm looking for is the guide or white paper or howto on how QoS is applied, so I understand the underlying concepts of how traffic is prioritized after it hits a device and is sent onward to it's destination. Some other questions I have are the following. I'll show in diagram format

PC A [sending packet to PB] ======IN> ASA5505-A ASA5505-B

1. What Interface would the packet need to have QoS policies applied on both asa 5505a and asa 5505b to ensure highest priorization and why?

2. If there is an IPSEC L2L VPN tunnel between the two where should these policies be applied?

thanks

[Terry Cheema · Accepted solution]

Ok lets say you want to priortise a particular traffic. (please note below is a high level procedure for your understanding, detailed commands etc are in the referenced documents)

1) You set a priority queue.

2) On ASA you can create class map to match the traffic passing throught the tunnel. (or can create an ACL to match specific traffic, or match the markings e.g. ef for voip)

3) After you have classified you can set the treatment policing/shaping/priortise

4) You apply this to outside interface

Where to apply:

Then apply this to the outside interface of the ASA on both ASA A and B.

Why to apply:

Congested part is WAN, you have limited bandwidth there, so you classify your traffic, give it proper markings and pass on to WAN - its then up to your service provider to honour/priortise those markings (as said already not done if its a normal internet connection).

Reference to detailed resources:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_qos.html#wp1172408

https://supportforums.cisco.com/docs/DOC-1230

Suggest you read this thorughly and apply accordingly.

Please rate helpful posts.

-Terry

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

You can "do" QoS on ingress or egress, although not all QoS features are supported for ingress and egress.

Generally on ingress, you might validate what you're receiving, and based on what you "seeing" drop, mark, remark and/or rate limit the ingress traffic.  Generally on egress, you deal with possible congestion, so you might prioritize some traffic over other traffic but you also might mark, remark, drop, rate limit and/or shape.

Ideally, a firewall, since it can selectively block traffic, should provide the same QoS support as other network devices, but if not, you might be able to provide the needed QoS on an upstream device.  For example, consider a FW without QoS features, but with a LAN FE interface and with a WAN DS3 interface.  Outbound traffic might queue on the FW DS3, but to manage that, external to the FW, the LAN device to the FW might shape for DS3 rate and manage congestion on it (before the FW "sees" the traffic).

For tunnels, of any type, again shaping for maximum tunnel transit bandwidth, not the tunnel device's physical interface bandwidth, could be the key to managing the tunnel's available bandwidth.