QoS RDP Traffic via IPSec Site2Site

Question

Hallo zusammen, 
 vielleicht k&ouml;nnt ihr mir Best&auml;tigen, ob meine L&ouml;sung korrekt ist oder totaler Murks. Ggf. habt ihr bessere Ideen oder sagt, dass meine Anforderung auf Grund des Tunnels gar nicht realisierbar ist. 
 
 Anforderung: Wir haben einen Terminalserver und unser ERP/WaWi in die Cloud ausgelagert. Zwischen unserem Netz (A) und dem Cloud Netz (B) besteht eine IPSec Verbindung. Die User greifen vom internen Netz i.d.R. via RDP auf den TS in der Cloud zu. F&uuml;r alle Services zwischen A und B soll ein QoS mit mind. 20000 kbit zugesicherter Geschwindigkeit greifen (100mbit Synchron gesamt Verf&uuml;gbar). 
 
 Meine Konfiguration: 
 Netz A (Internal): 172.15.2.0/24 
 Netz B (Cloud Netz): 192.168.5.0/24 
 Services: ANY 
 Verkehrskennzeichner: 
 1. Traffic OUT : Netz A --> ANY --> Netz B 
 2. Traffic IN : Netz B ---> ANY --> Netz A 
 Bandbreiten-Pools: 
 Gebunden an External: 
 Garantierte Bandbreite 20000 Kbit/s , Verkehrskennzeichner: Traffic OUT 
 Gebunden an Internal: 
 Garantierte Bandbreite 20000 Kbit/s , Verkehrskennzeichner: Traffic IN 
 
 Ist die Konfiguration so korrekt oder habe ich etwas &uuml;bersehen? 
 
 Gr&uuml;&szlig;e!

FormerMember · Accepted Answer

danny_mv Traffic selectors work based on service we specified so source and destination you can set based on your requirement. So this configuration should be able to achieve your goal. Further, you can refer to this document on page169 https://docs.sophos.com/nsg/sophos-utm/utm/9.6/pdf/en-us/administration-guide-9.600.pdf this will give more information about how to use QoS configuration.

FormerMember · Answer

danny_mv Thank you for contacting Sophos support. From google translator what I got is you need to apply QOS over IPsec for RDP service. For which make sure from advance tab under QoS option is enabled for Keep classification after encapsulation. This option could help to achieve what you looking for. 
 The assignment of an encapsulated IP packet to a traffic selector works as follows: 
 
 The original IP packet is compared with the existing traffic selectors in the given order. The packet is assigned to the first matching traffic selector (e.g., Internal -> HTTP -> Any). 
 The IP packet gets encapsulated, and the service changes (e.g., to IPsec). 
 The encapsulated packet is compared with the existing traffic selectors in the given order. The packet is assigned to the first matching traffic selector (e.g., Internal -> IPsec -> Any). 
 
 If no traffic selector matches, the assignment depends on the Keep classification after encapsulation option: 
 
 If the option is selected, the encapsulated packet will be assigned to the traffic selector found in step 1. 
 If the option is not selected, the encapsulated packet will not be assigned to any traffic selector and therefore cannot be part of a bandwidth pool.

QoS RDP Traffic via IPSec Site2Site

Top Replies