User manual

The pipe chaining can be used as a solution to the problem of VPN overhead. A limit which allows
for this overhead is placed on the VPN tunnel traffic and non-VPN traffic is inserted into a pipe that
matches the speed of the physical link.
To do this we first create separate pipes for the outgoing traffic and the incoming traffic. VoIP
traffic will be sent over a VPN tunnel that will have a high priority. All other traffic will be sent at
the best effort priority (see above for an explanation of this term). Again, we will assume a 2/2
Mbps symmetric link.
The pipes required will be:
• vpn-in
• Priority 6: VoIP 500 kpbs
• Priority 0: Best effort
Total: 1700
• vpn-out
• Priority 6: VoIP 500 kpbs
• Priority 0: Best effort
Total: 1700
• in-pipe
• Priority 6: VoIP 500 kpbs
Total: 2000
• out-pipe
• Priority 6: VoIP 500 kpbs
Total: 2000
The following pipe rules are then needed to force traffic into the correct pipes and precedence
levels:
Rule
Name
Forward
Pipes
Return
Pipes
Src
Int
Source
Network
Dest
Int
Destination
Network
Service Prec
vpn_voip_out vpn-out
out-pipe
vpn-in
in-pipe
lan lannet vpn vpn_remote_net H323 6
vpn_out vpn-out
out-pipe
vpn-in
in-pipe
lan lannet vpn vpn_remote_net All 0
vpn_voip_in vpn-in
in-pipe
vpn-out
out-pipe
vpn vpn_remote_net lan lannet H323 6
vpn_in vpn-in
in-pipe
vpn-out
out-pipe
vpn vpn_remote_net lan lannet All 0
out out-pipe in-pipe lan lannet wan all-nets All 0
in in-pipe out-pipe wan all-nets lan lannet All 0
With this setup, all VPN traffic is limited to 1700 kbps, the total traffic is limited to 2000 kbps and
VoIP to the remote site is guaranteed 500 kbps of capacity before it is forced to best effort.
SAT with Pipes
10.1.12. More Pipe Examples Chapter 10. Traffic Management
405