Application networking and configuration of AR18 Broadband Router IPSec + Qos

Application description:
A VPN is established between the branch AR1830) and the Headquarters R3640) through IPSec. In actual environments, AR18xx uses the PPPoE-Client dialing method to access the Internet, the Dialer port of the dial-up port dynamically obtains the IP address from the PPPoE Server, which determines that the PPPoE Client branch has a fixed public IP address with the Headquarters). The IPSec VPN can only be automatically negotiated by IKE. At the same time, in order to effectively and reasonably utilize network resources, enable OoS on the upstream port to ensure bandwidth for important data between IPSec VPNs.
Purpose: Enable QOS on the IPSec VPN of AR1830. The data stream sent from PC1 is defined as 5 with a Gold priority. at least 50% of the ADSL bandwidth must be guaranteed; data Streams sent from PC2 are defined as multimedia (priority 3). At least 20% of the ADSL bandwidth must be guaranteed; Network Management (Priority 7) must ensure 10% of the bandwidth, but when the network is not busy, each data stream can exceed the bandwidth defined by itself.
Implementation: The first step is to identify Gold and Multimedia on the Ethernet portal and set IP-precedence. for network management traffic, configure classifier to match data packets whose source address is Lo0 port, configure the car in the upstream port (adsl port) to set IP-precedence, and configure the EF queue to ensure priority forwarding. For the Multimedia and gold streams with IP-precedence typed at the Ethernet entry, make an AF queue on the uplink port to ensure bandwidth. Note that only the percentage bandwidth can be configured on the outbound interface, or only the specified digital bandwidth can be configured, you cannot configure the bandwidth as a percentage or 25%/25%/16 K as required by the customer. Therefore, you need to know the uplink bandwidth in advance and then calculate it by yourself, check whether the bandwidth is configured as a percentage or a digital bandwidth.
In addition, the QoS bandwidth of the ADSL interface is 640bps according to international standards.
Networking diagram:

Notes
1. QoS CBQ can only be applied to the PVC of the ATM interface and cannot be used directly on the ATM interface or Dialer port;
Detailed Configuration
Note: During the test, the Headquarters router R3640 is directly connected to AR4640 through the Ethernet port E2/0.
AR1830 Branch) Configuration:
Dis cur
#
Sysname Router
#
Ike local-name fenbu
#
Dialer-rule 1 ip permit
#
Ike peer zongbu
Exchange-mode aggressive
Pre-shared-key fenbu
Id-type name
Remote-name zongbu
Remote-address 162.105.66.36
Nat traversal
#
Ipsec proposal fenbu
#
Ipsec policy map1 1 isakmp
Security acl 3000
Ike-peer zongbu
Proposal fenbu
#
Interface Dialer1
Link-protocol ppp
Mtu 1450
Ip address ppp-negotiate
Dialer user test
Dialer-group 1
Dialer bundle 1
Ipsec policy map1
#
Interface Ethernet1/0
Ip address 202.150.1.31 255.255.255.0
#
Interface Atm2/0
#
Interface Atm2/0.1 p2p
Pvc 4/33
Map bridge Virtual-Ethernet1
#
Interface Virtual-Ethernet1
Pppoe-client dial-bundle-number 1
#
Interface NULL0
#
Acl number 3000
Rule 0 permit ip source 202.150.0.0 0.0.255.255 destination 202.150.0.0 0.0.255.255
Rule 1 deny ip
Acl number 3001
Rule 0 deny ip destination 202.150.0.0 0.0.255.255
Rule 1 permit ip
#
Ip route-static 0.0.0.0 0.0.0.0 Dialer 1 preference 60
#
User-interface con 0
Idle-timeout 0 0
User-interface vty 0 4
Authentication-mode none
User privilege level 3
#
Return

R3640 headquarters) Configuration:
Dis cur
#
Sysname Router
#
Ike local-name zongbu
#
Ike peer fenbu
Exchange-mode aggressive
Pre-shared-key fenbu
Id-type name
Remote-name fenbu
Remote-address 1.0.0.0 255.255.255.254
Nat traversal
#
Ipsec proposal zongbu
#
Ipsec policy map1 1 isakmp
Security acl 3000
Ike-peer fenbu
Proposal zongbu
#
#
Interface Aux0
Async mode flow
Link-protocol ppp
#
Interface Ethernet0/0