Enterprise QoS Solution Reference Network Design Guide

Chapter 6 IPSec VPN QoS Design
Prefragmentation
Version 3.3
Figure 6-6 IPSec and cRTP Incompatibility
IPSec
Crypto
Engine
Bandwidth Provisioning
!@#! $#@
!@#!
Configured
Queuing
Huh?
!@#!
Identify RTP
Traffic
RTP
Traffic
RTP
Compressor
Non-RTP
Traffic
The RTP compression engine cannot identify the stream as RTP,
(since it has been encrypted) and, thus, cannot compress the stream.
Site-to-Site V3PN QoS Considerations
Compress RTP
Traffic
Transmit
Queue
It is important to recognize that cRTP functions on a hop-by-hop basis, whereas IPSec can span multiple
intermediate (Layer 3) hops between IPSec endpoints. This distinction further exacerbates
incompatibility between the features.
Although developments are under way to address these incompatibilities, at the time of this writing,
cRTP cannot be utilized to achieve bandwidth savings in an IPSec VPN environment.
A problem arises when a packet is nearly the size of the maximum transmission unit (MTU) of the
outbound link of the encrypting router and then is encapsulated with IPSec headers. The resulting packet
is likely to exceed the MTU of the outbound link. This causes packet fragmentation after encryption,
which makes the decrypting router reassemble in the process path.
Cisco IOS Release 12.2(13)T introduced a new feature: prefragmentation for IPSec VPNs.
Prefragmentation increases the decrypting router’s performance by enabling it to operate in the
high-performance CEF path instead of the process path.
This feature enables an encrypting router to predetermine the encapsulated packet size from information
available in transform sets, which are configured as part of the IPSec security association. If it is
predetermined that the packet will exceed the MTU of the output interface, the packet is fragmented
before encryption. This function avoids process-level reassembly before decryption and helps improve
decryption performance and overall IPSec traffic throughput.
Prefragmentation for IPSec VPNs is enabled globally by default for Cisco VPN routers running Cisco
IOS Release 12.2(13)T or higher.
Chapter 1, “Quality of Service Design Overview,” presented the 33 Percent LLQ Rule, along with the
design rationale behind the recommendation. Furthermore, the rule was expressed as a conservative
design recommendation that might not be valid under all constraints. Provisioning for VoIP over IPSec
on slow links sometimes poses constraints that might preclude applying the 33 Percent LLQ Rule.
!@#!
!@#! !@#!
Enterprise QoS Solution Reference Network Design Guide
6-9