ASA's traffic policy(QoS) for ipsec VPN tunnels

Question

i have ipsec l2l VPN over internet, I wander if there is default policy in ASA for making ipsec traffic with higher priority? My question basically is, if one of packet from two packets must be dropped, which one will it be ipsec or any other? what is the default?

Answer 1

It depends on what the real bottleneck is, where it is located and if you have any QoS treatments in place.

Assuming the bottleneck is the available bandwidth by the provider and you have no treatments in place, both packets will exit out of your Firewall and the provider makes a decision on whether to drop the traffic.

Both packets ingress their respective interfaces. One into the tunnel and another for the outside interface. The firewall sees these as two logical interfaces though they are the same physical interface. Since both interfaces can handle the traffic, both packets exit, unchallenged.

Again the circuit provider will do what it wants with the traffic.

Answer 2

Unless your circuit provider is honoring QoS over the entire path between you and the other end of the tunnel, your traffic is at the mercy of the traffic control of every network you transit.

Once the traffic enters this uncontrolled space (think the Internet) packet behavior is unpredictable. There is nothing that can be done to prevent packet drops once the traffic enters the l2l VPN tunnel.

End-to-End QoS is required to change the likelyhood of a packet being dropped as it transits the network. End-to-End QoS is typically reserved for Enterprise Grade private circuits as an additional feature/product of the service. A QoS-enabled MPLS circuit or QoS- MetroEthernet circuit would be an example. Business grade DLS or cable Internet would not be such examples.

However, only traffic destined within the private circuit would be protected.