Putting QOS on IPSEC site to site tunnel

Hi group,

I have 2 astaros, one at each location.

Have an IPSEC vpn tunnel setup between the two.

I would like place QOS on this tunnel for all traffic. I've created a config, but I don't think it is working. Anyone have this working successfully care to share their setup?

First, from my understanding, QOS only works outbound correct? If this is true, I would need an outbound at site A and an outbound at site B to get bidirectional QOS over vpn right?

Second, is the QOS applied to the external interface only for outbound traffic?

Third, if the traffic is encrypted once it reaches the External interface, can the astaro see the traffic in order to apply QOS to it?

Thanks
Tom