What is IPsec anti-replay, and why can QoS cause anti-replay drops?
Show the answer
Say this first
Every ESP packet carries a sequence number. The receiver keeps a sliding window, 64 packets by default on IOS, and drops packets whose number it has already seen or that fall behind the window. That stops an attacker from replaying captured packets. But the sequence number is assigned at encryption, before the output queue. If QoS then sends voice ahead of queued bulk data, some bulk packets arrive more than 64 behind the newest one and are dropped as replays, even though they are genuine.
Go deeper
Other causes of reordering
Per-packet load sharing across two paths, or a provider network that reorders under load.
Evidence
IOS logs %CRYPTO-4-PKT_REPLAY_ERR with the connection ID and sequence number of the dropped packet.
Fixes on IOS
! global
crypto ipsec security-association replay window-size 1024
! or per crypto map entry
crypto map VPNMAP 10 ipsec-isakmp
set security-association replay window-size 1024A wider window tolerates more reordering. Disabling the check
(set security-association replay disable) works but removes the protection.
They will ask next
Why not just disable anti-replay?
It is a security control. Without it, an attacker on the path can resend captured packets and the receiver accepts them. Widen the window first, and disable only with a reason and a recorded risk decision.
What does
qos pre-classifydo on a tunnel?It lets the QoS policy on the physical interface classify on the original inner header (addresses and ports), not just the outer one. The DSCP value is copied to the outer header by default, so DSCP-only policies work without it.
Traps
- Assuming replay errors mean an attack. On real networks they are almost always QoS or path reordering.