315
Enabling QoS pre-classify
CAUTION:
If you configure both IPsec and QoS on an interface, make sure the IPsec traffic classification rules
match the QoS traffic classification rules. If the rules do not match, QoS might classify the packets o
one IPsec SA to different queues, causing packets to be sent out of order. When IPsec anti-replay is
enabled, IPsec will drop the incoming packets that are out of the anti-replay window, resulting in
packet loss.
If you apply both an IPsec policy and a QoS policy to an interface, QoS classifies packets by using
the new headers added by IPsec. If you want QoS to classify packets by using the headers of the
original IP packets, enable the QoS pre-classify feature.
IPsec traffic classification rules are determined by the rules of the specified ACL. For more
information about QoS policy and classification, see ACL and QoS Configuration Guide.
To enable the QoS pre-classify feature:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter IPsec policy view or
IPsec policy template view.
• To enter IPsec policy view:
ipsec { policy | ipv6-policy }
policy-name seq-number
[ isakmp | manual ]
• To enter IPsec policy
template view:
ipsec { policy-template |
ipv6-policy-template }
template-name seq-number
N/A
3. Enable QoS pre-classify.
qos pre-classify
By default, QoS pre-classify is
disabled.
Enabling logging of IPsec packets
Perform this task to enable the logging of IPsec packets that are discarded because of reasons such
as IPsec SA lookup failure, AH-ESP authentication failure, and ESP encryption failure. The log
information includes the source and destination IP addresses, SPI value, and sequence number of a
discarded IPsec packet, and the reason for the discard.
To enable the logging of IPsec packets:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enable the logging of IPsec
packets.
ipsec logging packet enable
By default, the logging of IPsec
packets is disabled.
Configuring the DF bit of IPsec packets
Perform this task to configure the Don't Fragment (DF) bit in the new IP header of IPsec packets in
one of the following ways:
• clear—Clears the DF bit in the new header.
• set—Sets the DF bit in the new header.
To Next Page
Loading...
Need help?
General