i have ipsec l2l VPN over internet, I wander if there is default policy in ASA for making ipsec traffic with higher priority? My question basically is, if one of packet from two packets must be dropped, which one will it be ipsec or any other? what is the default?

2 Answers 2


It depends on what the real bottleneck is, where it is located and if you have any QoS treatments in place.

Assuming the bottleneck is the available bandwidth by the provider and you have no treatments in place, both packets will exit out of your Firewall and the provider makes a decision on whether to drop the traffic.

Both packets ingress their respective interfaces. One into the tunnel and another for the outside interface. The firewall sees these as two logical interfaces though they are the same physical interface. Since both interfaces can handle the traffic, both packets exit, unchallenged.

Again the circuit provider will do what it wants with the traffic.

  • that makes sence,thanks for the explanation. Dec 16, 2016 at 14:59

Unless your circuit provider is honoring QoS over the entire path between you and the other end of the tunnel, your traffic is at the mercy of the traffic control of every network you transit.

Once the traffic enters this uncontrolled space (think the Internet) packet behavior is unpredictable. There is nothing that can be done to prevent packet drops once the traffic enters the l2l VPN tunnel.

End-to-End QoS is required to change the likelyhood of a packet being dropped as it transits the network. End-to-End QoS is typically reserved for Enterprise Grade private circuits as an additional feature/product of the service. A QoS-enabled MPLS circuit or QoS- MetroEthernet circuit would be an example. Business grade DLS or cable Internet would not be such examples.

However, only traffic destined within the private circuit would be protected.

  • i asked my question very poorly)). Actually i want to know what happens, if the bottleneck is on my outside interface? will the user who wants to access facebook go first or traffic from ipsec tunnel? if they both use tcp 443 per say? is there any default QoS by Cisco to prioritize traffic? Dec 15, 2016 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.