VPN traffic needs to be classified based on the Layer2 header information
VPN traffic needs to be classified based on the IP precedence or DSCP
VPN traffic needs to be classified based on IP flow or Layer 3 information, such as source and destination IP address
VPN traffic with Authentication Header (AH) needs to preserve the ToS byte