Enterprise QoS Solution Reference Network Design Guide

Teleworker V3PN QoS Considerations
Bandwidth Provisioning
6-32
Enterprise QoS Solution Reference Network Design Guide
Chapter 6 IPSec VPN QoS Design
DOCSIS 1.1 also provides the capabilities to shape traffic at Layer 2 before transmission over the cable
network. Although the circuit and frequencies physically are shared, access to the medium can be
controlled by the headend so that a device can be guaranteed specified bandwidth.
At the time of this writing, the only recommended deployment model for cable is the Integrated Unit +
Access Model, as shown in Figure 6-22.
Figure 6-22 Teleworker Deployment Model for Cable
Integrated Unit +
Access Model
A few key differences with respect to bandwidth provisioning need to be taken into account for
broadband teleworker scenarios, as compared to site-to-site VPNs.
The first is that usually only a single call needs to be provisioned for (unless two teleworkers share a
single residential broadband connection, which is rarely the case). If bandwidth is low, G.729 codecs are
recommended. The second key bandwidth-provisioning consideration is the inclusion of the overhead
required by the broadband access technologies, whether DSL or cable.
Note Sometimes multicast support is not required in a teleworker environment. For example, routing protocols
(which depend on multicast support) might not be required by teleworkers (because default gateways are
usually sufficient in this context). In such cases, IPSec tunnel mode (no encrypted IP GRE tunnel) can
be used to achieve additional bandwidth savings of 24 bytes per packet.
For the remainder of this chapter, IPSec tunnel mode (no encrypted IP GRE tunnel) is the assumed mode
of operation.
NAT Transparency Feature Overhead
IP
831/171X DSL
Modem
DSL
Backbone
To Enterprise
Beginning in Cisco IOS Release 12.2(13)T, NAT transparency was introduced and is enabled by default,
provided that both peers support the feature. It is negotiated in the IKE exchange between the peers. This
feature addresses the environment in which IPSec packets must pass through a NAT/pNAT device, and
it adds 16 bytes to each voice and data packet. The overhead that this feature adds is shown in
Figure 6-23.
Version 3.3