DMVPN and QoS

[Michael Grann]

Hello everyone,

If you configure a service-policy output on an interface that terminates/participates in DMVPN, does IOS perform traffic stats/counters before or after the traffic is encrypted? And do you also need "ip flow egress" configured for your network mgmt software to correctly account netflow statistics?

The reason I'm asking is that my Netflow traffic stats (util, pps, ToS, etc) don't seem to correctly show accurate data. I know the link is using at least 50% of the pipe, but Netflow stats imply only non-encrypted traffic.

Regards,

MikeG

[Marius Gunnerud]

When you say you configure the service-policy on an ouput interface, do you mean the physical interface as int gig0/1 (or whatever it may be) or are you talking about the virtual tunnel interface?  The correct method would be to apply the service policy to the virtual tunnel interface/s as well as to apply the ip flow egress command on these interfaces as well.

then you should start seeing correct netflow stats.

--

Please remember to select a correct answer and rate helpful posts