EZ-VPN and QoS

[brian.k.clarke]

We're looking to deploy an EZ-VPN solution using Cisco ASA 5505s at remote locations tying back to a 5520 EZ-VPN server. I'm familiar with the EZ-VPN configuration, as well as deploying QoS for remote access VPNs.  I'm also aware of using QoS pre-classification on Cisco IOS firewalls to provide QoS over site-to-site VPNs (haven't found this same functionality on ASAs yet, strangely).  I've been through the ASA configuration guide VPN content, and haven't found anything.

What I need to confirm is if QoS (for voice/video traffic - DSCP settings) can also be deployed for site-to-site VPNs on ASAs, specifically EZ-VPN connections. If it's possible, some configuration guidelines/examples would be awesome.

Thank you

[Marcin Latosiewicz]

Hi,

ASA's QoS implmentation is much less robust than a routers.

You have possibility to match flows per-tunnel-group configured (match tunnel-group clause), and also perf DSCP valued (which should be copied from internal to external header)

The configuration guide specific to QoS is located here:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_qos.html

Let me know what you're trying to accomplish and I might be of more help, mind that I'm not big on QoS ;-)

Marcin

[brian.k.clarke]

I specifically need to know if I can prioritize voice (DSCP 46/ef, for example) traffic over an ASA VPN connection established with EZ-VPN.

I've been through the QoS guide and the ASA EZ-VPN material, but can't seem to find an absolute answer on this.

Thanks again for your help!

[Marcin Latosiewicz]

Hello again,

DSCP/TOS values should be copied from inner header to outter header.

Check RFC 4301 section 5.1.2.2. (or 2401 section 5.1.2.1)

So there is no problem to match DSCP of inner packet.

Please remember that ASA supports ONE priority queue (per interface) - i.e. choose wisely what you're going to prioritize.

You can match on particular tunnel group as stated before.

Marcin