IPsec Class of Service (CoS) JN0-637 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is planning to deploy an IPsec VPN to connect two sites. The VPN will carry a mix of real-time and non-real-time traffic. The network team wants to ensure that real-time traffic is prioritized over non-real-time traffic. What is the first step they should take to implement CoS for the IPsec VPN?

   • AEnable 'tunnel-gre' encapsulation to improve CoS support.
   • BClassify traffic into different forwarding classes based on application requirements.
   • CApply a scheduler map to the tunnel interface to prioritize traffic.
   • DConfigure a rewrite rule on the tunnel interface to mark traffic.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An administrator has configured CoS on an IPsec tunnel to prioritize voice traffic. The configuration includes a firewall filter that marks voice traffic with DSCP EF and a scheduler map that assigns strict priority to the EF queue. However, voice traffic is still experiencing high latency. The administrator has verified that the firewall filter is matching voice traffic correctly. What should the administrator check next?

   • ACheck the IPsec security association's encryption algorithm to ensure it is not adding latency.
   • BVerify that the scheduler map is applied to the correct interface and that the EF queue is actually being used.
   • CVerify that the tunnel interface's MTU is set correctly to avoid fragmentation.
   • DCheck the routing table to ensure that voice traffic is being routed through the tunnel.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A network administrator is configuring CoS on an IPsec tunnel interface. The tunnel carries voice, video, and data traffic. The administrator wants to ensure that voice traffic is always served first, video traffic is served next, and data traffic is served last. The administrator has configured a scheduler map with three queues: voice (strict-priority), video (strict-priority), and data (best-effort). What is the potential issue with this configuration?

   • AThe tunnel interface must have a 'shaping-rate' configured to ensure the scheduler works correctly.
   • BThe scheduler map does not specify a transmit-rate for the data queue, so data traffic will be dropped.
   • CVoice and video queues are both strict-priority, so video could starve voice if video traffic is heavy.
   • DThe scheduler map must include a 'priority' statement for each queue to define the order.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization uses an IPsec VPN to connect multiple remote sites. The VPN carries a mix of real-time video conferencing and standard web traffic. The network team wants to ensure that video conferencing traffic is treated with higher priority than web traffic within the tunnel. They have configured a firewall filter that classifies video traffic into the 'af41' forwarding class and web traffic into 'best-effort'. What else must be configured to ensure the video traffic is actually prioritized?

   • ASet the tunnel interface's 'preference' to a higher value to prioritize video routing.
   • BApply a scheduler map to the tunnel interface that assigns a higher transmit-rate to the af41 queue than the best-effort queue.
   • CConfigure a policer on the tunnel interface that limits web traffic to a lower rate.
   • DEnable 'tunnel-gre' encapsulation to reduce overhead and improve performance.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A service provider offers an IPsec VPN service to customers. The provider's network uses DSCP-based CoS to prioritize traffic. A customer has configured their CE router to mark voice traffic with DSCP EF, but the provider's PE router is rewriting the DSCP value to AF31 because of a default policy. The customer complains that voice quality is poor. The provider wants to honor the customer's markings without compromising the network's CoS plan. What should the provider do?

   • ADisable DSCP rewriting on the PE router entirely to preserve the customer's original markings.
   • BConfigure a firewall filter on the PE router's ingress interface that re-marks DSCP EF back to EF after the default rewrite, and then apply a rewrite rule to set the outer DSCP to EF.
   • CChange the PE router's default CoS policy to trust customer markings for the specific VPN, and apply a rewrite rule that maps DSCP EF to the appropriate outer DSCP value.
   • DConfigure a CoS rewrite rule on the PE router's ingress interface that maps DSCP EF to the same forwarding class as AF31, but preserves the original DSCP in the outer header.
   Reveal Solution Discussion Select an answer first