Only want the pre-classify configured on the crypto map. Then you can match on the original source/destination addresses and protocol.
You are only encrypting GRE traffic per the crypto map. Is the voice traffic flowing through the tunnel or via the physical interface. All the service policy is seeing is GRE with pre-classify if the traffic is through the tunnel. Modify the service-policy to match on dscp ef. Then place another service policy to match on an acl ingress on the inside interface and set dscp ef. Then the gre header will be marked ef for voice traffic, the ipsec will be marked ef, and your egress policy will then prioritize ef. David -- http://dcp.dcptech.com > -----Original Message----- > From: false [mailto:[email protected]] > Sent: Friday, April 05, 2013 10:05 AM > To: 'cisco mailing list'; David Prall > Subject: RE: [c-nsp] QoS not working - VPN acl conflicting??? > > Still stuck. Keep in mind that I am trying to make the QoS policy work on > traffic that is NOT going over the tunnel. This is voip traffic going to my > provider. I tried using the qos-preclassify command at the crypto map level > and the tunnel interface and then did huge transfers from branch to branch > just to saturate my T-1 and it did, but the policy never reserved/prioritized > my voip traffic. > > Serial0/1/0 is up, line protocol is up > Hardware is GT96K with integrated T1 CSU/DSU > Internet address is x.x.x.x/30 > MTU 1500 bytes, BW 1544 Kbit/sec, DLY 20000 usec, > reliability 255/255, txload 231/255, rxload 16/255 > > Service-policy output: VOIPpm > queue stats for all priority classes: > queue limit 64 packets > (queue depth/total drops/no-buffer drops) 0/0/0 > (pkts output/bytes output) 0/0 > > Class-map: VOIPcm (match-all) > 0 packets, 0 bytes > 5 minute offered rate 0 bps, drop rate 0 bps > Match: access-group 156 > Priority: 33% (509 kbps), burst bytes 12700, b/w exceed drops: 0 > > Class-map: class-default (match-any) > 1437759 packets, 848687414 bytes > > >From my research, it looks like the qos-preclassify command only affects > traffic going over the tunnel. Any help would be very much appreciated. > > > --- On Thu, 4/4/13, David Prall <[email protected]> wrote: > > > From: David Prall <[email protected]> > > Subject: RE: [c-nsp] QoS not working - VPN acl conflicting??? > > To: "'false'" <[email protected]>, "'cisco mailing list'" <cisco- > [email protected]> > > Date: Thursday, April 4, 2013, 12:11 PM > > Need to turn on Pre-Classify in the > > ipsec crypto map. Otherwise all you are > > seeing is the ipsec traffic. > > > > David > > > > -- > > http://dcp.dcptech.com > > > > > -----Original Message----- > > > From: [email protected] > > [mailto:cisco-nsp- > > > [email protected]] > > On Behalf Of false > > > Sent: Thursday, April 04, 2013 12:49 PM > > > To: cisco mailing list > > > Subject: [c-nsp] QoS not working - VPN acl > > conflicting??? > > > > > > > > > Hello, > > > I have a QoS policy in place that is set to > > reserve/prioritize traffic > > for my > > > outgoing VoIP traffic. We outsource our voip solution. > > > > > > I am trying to test my QoS policy by performing > > multiple file transfers > > > outbound to our remote site over vpn which uses the > > same interface. You > > > can see by the txload stats below that it should have > > been high enough to > > > make the voip policy kick in bit it didn't. There were > > about six phones > > > connected but not being used. They are just doing > > keepalives for > > > regisration, etc to the main server, which is indicated > > in the access list > > > below. Any ideas? Thank you, > > > > > > Serial0/1/0 is up, line protocol is up > > > Hardware is GT96K with integrated T1 CSU/DSU > > > Internet address is x.x.x.x/30 > > > MTU 1500 bytes, BW 1544 Kbit/sec, DLY 20000 usec, > > > reliability 255/255, txload 218/255, rxload 19/255 > > > > > > router#sh policy-map interface serial 0/1/0 > > > Serial0/1/0 > > > > > > Service-policy output: VOIPpm > > > queue stats for all priority classes: > > > queue limit 64 packets > > > (queue depth/total drops/no-buffer drops) 0/0/0 > > > (pkts output/bytes output) 0/0 > > > > > > Class-map: VOIPcm (match-all) > > > 0 packets, 0 bytes > > > 5 minute offered rate 0 bps, drop rate 0 bps > > > Match: access-group 156 > > > Priority: 33% (509 kbps), burst bytes 12700, b/w exceed > > drops: 0 > > > > > > > > > Class-map: class-default (match-any) > > > 898811 packets, 199817314 bytes > > > 5 minute offered rate 23000 bps, drop rate 3000 bps > > > Match: any > > > Queueing > > > queue limit 64 packets > > > (queue depth/total drops/no-buffer drops/flowdrops) > > 0/81175/0/81175 > > > (pkts output/bytes output) 824273/184794616 > > > Fair-queue: per-flow queue limit 16 > > > router# > > > > > > > > > CONFIG: > > > access-list 156 permit ip any host 66.x.x.x.x > > > > > > class-map match-all VOIPcm > > > match access-group 156 > > > > > > policy-map VOIPpm > > > class VOIPcm > > > priority percent 33 > > > class class-default > > > fair-queue > > > > > > interface Serial0/1/0 > > > ip address 150.150.150.150 255.255.255.252 > > > ip access-group 101 in > > > ip flow ingress > > > ip flow egress > > > ip nat outside > > > ip inspect ISP2-cbac out > > > ip virtual-reassembly > > > encapsulation ppp > > > crypto map vpnmap > > > service-policy output VOIPpm > > > end > > > > > > crypto map vpnmap 21 ipsec-isakmp > > > set peer x.x.x.x > > > set transform-set vpn_set > > > match address 121 > > > crypto map vpnmap 32 ipsec-isakmp > > > set peer x.x.x.x > > > set transform-set vpn_set > > > match address 132 > > > > > > access-list 121 permit gre host 150.150.150.150 host > > 67.x.x.x. > > > access-list 132 permit gre host 150.150.150.150 host > > 57.x.x.x.x > > > > > > _______________________________________________ > > > cisco-nsp mailing list [email protected] > > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
