Blog

Quality of Service (QoS) is the set of tools a network uses to decide which packets matter most when there is not enough bandwidth, buffer space, or serialization time for all of them. On the CCNP ENCOR 350-401 v1.2 blueprint, QoS appears in the Architecture domain under “Describe concepts of wired and wireless QoS”, split into QoS components and QoS policy. The verb is “describe”, so the exam tests understanding of the mechanisms and where they belong rather than raw configuration syntax. The configuration in this article goes past that bar deliberately: the fastest way to understand a token bucket or a low-latency queue is to build one and watch the counters move.

Why QoS Exists: The Four Impairments

Every QoS discussion reduces to four measurable impairments. Each tool in the toolbox exists to attack one or more of them.

Delay Is Four Things, Not One

• Propagation delay — physics. Roughly 5 microseconds per kilometre of fibre. Nothing in a QoS policy changes it.
• Serialization delay — time to clock the bits onto the wire. A 1500-byte frame on a 1 Mbps link takes 12 ms; on 1 Gbps it takes 12 microseconds. This is why link fragmentation mattered on slow WAN links and is irrelevant at Ethernet speeds.
• Processing delay — lookup and rewrite time, negligible on hardware-forwarding platforms.
• Queuing delay — the only component QoS directly controls, and typically the dominant one during congestion.

Service-Level Targets Worth Memorizing

How Congestion Actually Happens

Congestion is not simply “the link is full on average.” Three patterns produce drops on links that look lightly loaded in a five-minute SNMP graph:

• Speed mismatch — a 10 Gbps server transmitting to a 1 Gbps WAN handoff. The egress buffer absorbs the difference until it cannot.
• Aggregation / many-to-one — twenty access ports feeding a single uplink, or an incast pattern where many servers answer one request simultaneously.
• Microbursts — sub-millisecond bursts that overrun buffers while the interface averages 20% utilization. Interface counters show output drops that no utilization graph explains.

When a tail-drop queue fills, every TCP flow in it loses packets at nearly the same instant, every flow halves its window at the same instant, and the link goes idle before all flows ramp back up together. This is TCP global synchronization, and it is the reason congestion-avoidance mechanisms such as WRED exist. The opposite failure — buffers so deep that packets sit for hundreds of milliseconds instead of being dropped — is bufferbloat, which destroys interactive traffic while TCP throughput looks fine.

The Three QoS Models

Best Effort

No classification, no differentiation, FIFO everywhere. Simple and infinitely scalable, with zero guarantees. This remains the correct answer for links that are never congested.

Integrated Services (IntServ)

IntServ provides hard, per-flow guarantees using RSVP (Resource Reservation Protocol) to signal a reservation end to end. Each device along the path performs admission control and either accepts the flow or rejects it. The model is often called the “hard QoS” or “telephone” model: a call either gets its resources or is refused.

• Strengths: explicit admission control, per-flow guarantees, prevents oversubscription of the priority queue.
• Weaknesses: every hop must keep per-flow state, which does not scale to core links carrying millions of flows. Requires RSVP support everywhere.
• Where it survives: RSVP-based Call Admission Control in collaboration deployments, and RSVP-TE in MPLS traffic engineering.

Differentiated Services (DiffServ)

DiffServ is the model deployed in virtually every modern enterprise. Traffic is classified into a small number of aggregate classes at the network edge and marked in the packet header. Every subsequent hop simply reads the mark and applies a Per-Hop Behavior (PHB) — a locally defined forwarding treatment. There is no signalling and no per-flow state in the core.

Two consequences follow, and both appear regularly in exam questions and in real outages:

• DiffServ is per-hop. A marking means nothing unless a device is configured to act on it. A network where every access switch marks EF but no uplink has a queuing policy has no QoS at all.
• DiffServ provides no admission control. Nothing stops a hundred voice calls from entering a priority queue sized for thirty. Admission control must come from somewhere else (CUCM locations, RSVP, or a policer).

Marking: Where the Bits Live

Layer 2 Markings

• 802.1p CoS — three bits (the Priority Code Point) inside the 802.1Q VLAN tag, giving values 0–7. Critical limitation: an untagged frame has no CoS field. CoS survives only on trunks and on the voice VLAN of an access port, and is destroyed the moment the frame crosses a router.
• MPLS EXP / Traffic Class — three bits in the MPLS shim header, used by service providers to carry a compressed version of the customer’s DSCP across the core.
• 802.11 User Priority (UP) — three bits in the 802.11 QoS Control field, used by WMM. Covered in the wireless section below.

Layer 3 Markings: The DiffServ Field

The second byte of the IPv4 header (the legacy Type of Service byte) and the IPv6 Traffic Class byte are both interpreted as the DiffServ field:

IP Precedence is the legacy three-bit interpretation (values 0–7). DSCP is the modern six-bit interpretation (values 0–63). The first three DSCP bits are the same bits as IP Precedence, which is what makes the Class Selector values backward compatible.

The remaining two bits are ECN (Explicit Congestion Notification):

The Standard PHBs

Default (DF) — DSCP 0, best effort, FIFO.

Class Selector (CSx) — DSCP values whose last three bits are zero, mapping one-to-one onto IP Precedence. CSx = x × 8.

Assured Forwarding (AFxy) — four classes (x = 1–4) each with three drop precedences (y = 1–3). Higher y means more likely to be dropped. All three drop precedences of one class share a queue; the drop precedence only influences which packets WRED discards first. The conversion formula is worth memorizing:

DSCP(AFxy) = 8x + 2y

AF31 = (8 × 3) + (2 × 1) = 26
AF43 = (8 × 4) + (2 × 3) = 38

Expedited Forwarding (EF) — DSCP 46 (101110), the low-loss, low-latency, low-jitter PHB reserved for voice. RFC 5865 adds Voice-Admit (DSCP 44, 101100) for admitted voice flows.

DSCP Reference Table

RFC 4594 / Cisco 12-Class Model

RFC 4594 provides the marking recommendations that Cisco’s designs follow. Memorizing this table answers a large share of QoS design questions.

Networks rarely deploy all twelve classes. The common reductions are 4-class (voice, signalling/control, transactional, best effort), 8-class, and 12-class, and the model chosen must match end to end — including whatever the service provider offers, which is frequently only 4 to 6 classes.

Trust Boundaries

A trust boundary is the point where the network begins believing the markings arriving in packets. The design rule: mark as close to the source as possible, and trust as close to the source as is safe.

An unmanaged PC can set any DSCP it likes. A user who discovers that marking their game traffic EF gets it into the priority queue has effectively taken over the voice queue. Consequently:

• Trusted — IP phones, access points, managed servers, controlled uplinks. Accept incoming DSCP/CoS.
• Untrusted — user PCs, printers, guest devices, anything on a port a visitor can reach. Rewrite the marking at ingress, or force it to 0.
• Conditional trust — the port trusts markings only while a Cisco IP phone (or an AP) is detected via CDP/LLDP. If the phone is unplugged and a laptop is connected in its place, trust collapses automatically.

Where an endpoint cannot be trusted but its traffic still needs classification, the access edge marks it using an ingress MQC policy that matches by protocol, port, ACL, or NBAR2 application.

QoS Components: The Toolbox

These are the “QoS components” the blueprint refers to. Every one of them is a per-hop behaviour applied in a specific direction, and direction matters more than anything else in troubleshooting.

1. Classification

Deciding which class a packet belongs to. Methods, roughly from cheapest to most expensive:

• Marking-based — match dscp ef, match cos 5, match precedence 5, match mpls experimental topmost. Fastest; used at every hop past the edge.
• ACL-based — match access-group name VOICE-SIGNALING, matching addresses, protocols, and port ranges.
• Interface / VLAN based — match input-interface, match vlan.
• NBAR2 — deep packet inspection identifying over 1,400 applications, including encrypted traffic via SD-AVC and heuristics. match protocol webex-meeting. Expensive in CPU, used at the edge only.
• Internal labels — qos-group and discard-class, which carry a classification decision between policies inside one device without touching packet headers.

Inside a class-map, match-all requires every condition (logical AND) and match-any requires one (logical OR). Within a policy-map, classes are evaluated top down, first match wins, and everything unmatched falls into class-default.

2. Marking

Writing the classification decision into the packet or frame so downstream hops do not need to reclassify: set dscp, set cos, set precedence, set qos-group. Related tools include table maps, which translate one field to another wholesale (for example CoS-to-DSCP or DSCP-to-DSCP mutation at an administrative boundary) instead of writing dozens of class-maps.

3. Policing

Enforcing a rate by dropping or re-marking excess traffic. Policing does not buffer, so it does not add delay — it adds loss, and TCP reacts badly to it. Policers may be applied inbound or outbound; inbound is the usual choice.

The mechanism is a token bucket. Tokens accumulate at the Committed Information Rate (CIR); a packet may be forwarded only if the bucket holds enough tokens for its size. The bucket depth is the committed burst, Bc, expressed in bytes on IOS policers.

Actions per colour: transmit, drop, set-dscp-transmit, set-prec-transmit, set-clp-transmit. The most useful pattern is not “drop the excess” but “re-mark the excess to a scavenger value and let it through if there is room” — a soft policer.

4. Shaping

Enforcing a rate by buffering and delaying excess traffic. Shaping smooths bursts into a steady stream, so TCP tolerates it far better than policing. Shaping is egress only, and it introduces delay and requires memory.

Tc (interval)  = Bc / CIR
Bc (bits)      = CIR × Tc

Example: CIR = 20 Mbps, target Tc = 10 ms
Bc = 20,000,000 × 0.010 = 200,000 bits per interval

The shaper releases Bc bits every Tc interval. A long interval means large, bursty releases and poor jitter behaviour for voice; a short interval means smoother output. Platform defaults vary, and a Tc of about 10 ms is the usual recommendation when voice rides the shaped link.

The classic use case is a sub-rate handoff: a physical GigabitEthernet interface to a carrier who only sells 20 Mbps. Without a shaper the router transmits at 1 Gbps, the carrier polices at 20 Mbps, and the drops happen in the provider’s equipment where no local queuing policy can protect voice. Shaping to the contracted rate moves the congestion point back inside the router, where the queuing policy can act on it.

5. Congestion Management (Queuing)

Queuing decides the order of departure once a queue has formed. It only takes effect during congestion — a fact that surprises people watching an empty policy on an uncongested link.

• FIFO — single queue, default on high-speed interfaces.
• WFQ (Weighted Fair Queuing) — flow-based, automatically favours low-volume flows, weighted by IP Precedence. Historically the default on serial links at or below 2.048 Mbps. No explicit class control.
• CBWFQ (Class-Based WFQ) — a queue per user-defined class with a guaranteed minimum bandwidth. A class may exceed its guarantee when other classes are idle.
• LLQ (Low-Latency Queuing) — CBWFQ plus a strict-priority queue serviced ahead of everything else. The priority queue is implicitly policed at its configured rate during congestion, which prevents a flood of EF traffic from starving every other class. LLQ is the tool for voice.

Bandwidth can be expressed three ways, and mixing them inside one policy is rejected:

• bandwidth 512 — absolute kbps.
• bandwidth percent 20 — percentage of the interface bandwidth (or of the parent shaper’s rate in a hierarchical policy).
• bandwidth remaining percent 30 — percentage of what is left after the priority queues take their share. This is the form to use in hierarchical policies, because it scales automatically when the parent shaper’s rate changes.

By default, only 75% of interface bandwidth may be reserved by CBWFQ classes; the remainder is held back for control-plane and Layer 2 overhead. max-reserved-bandwidth changes this, and should be changed knowingly rather than reflexively.

6. Congestion Avoidance

Managing the queue before it overflows.

• Tail drop — the default: once the queue is full, discard everything else. Causes global synchronization.
• WRED (Weighted Random Early Detection) — begins dropping randomly once average queue depth passes a minimum threshold, dropping more aggressively as depth rises toward the maximum threshold, above which everything is dropped. The drop probability at the maximum threshold is the Mark Probability Denominator (MPD, default 1/10).
• DSCP-based WRED — different thresholds per DSCP, which is precisely how AF drop precedence becomes meaningful: AF13 starts being dropped well before AF11.
• ECN — instead of dropping an ECN-capable packet, set the CE bits and let the receiver signal the sender to slow down. Congestion feedback without loss.

WRED is for TCP. Applying it to voice or to a priority queue is a configuration error — UDP does not back off, so the drops are pure damage.

7. Link Efficiency (Legacy)

Relevant mainly to slow WAN links and to exam history: LFI (Link Fragmentation and Interleaving) and MLPPP with interleaving chop large frames so voice can be interleaved between fragments; cRTP compresses the 40-byte IP/UDP/RTP header down to 2–4 bytes. At Ethernet speeds serialization delay is negligible and these tools are obsolete.

QoS Policy: The MQC Framework

Modular QoS CLI is the configuration model on IOS, IOS-XE, and (with platform differences) on the Catalyst 9000 and Catalyst 9800 series. Three steps, always in the same order:

! 1. class-map — WHAT is the traffic?
class-map match-any VOICE
 match dscp ef

! 2. policy-map — WHAT should happen to it?
policy-map WAN-EDGE
 class VOICE
  priority percent 10

! 3. service-policy — WHERE and in which direction?
interface GigabitEthernet0/0/0
 service-policy output WAN-EDGE

A Complete WAN Edge Policy

An eight-class egress policy for a 20 Mbps sub-rate Ethernet handoff on a physical GigabitEthernet interface. Note the hierarchical structure: the parent shapes to the contracted rate, the child queues within it.

! ---------- Classification ----------
class-map match-any VOICE
 match dscp ef
class-map match-any SIGNALING
 match dscp cs3
 match dscp af31
class-map match-any VIDEO
 match dscp af41 af42 af43
 match dscp cs4
class-map match-any NET-CTRL
 match dscp cs6
 match dscp cs2
class-map match-any TRANSACTIONAL
 match dscp af21 af22 af23
class-map match-any BULK
 match dscp af11 af12 af13
class-map match-any SCAVENGER
 match dscp cs1

! ---------- Child policy: queuing ----------
policy-map WAN-QUEUING
 class VOICE
  priority percent 10
 class VIDEO
  bandwidth remaining percent 25
  random-detect dscp-based
 class SIGNALING
  bandwidth remaining percent 5
 class NET-CTRL
  bandwidth remaining percent 5
 class TRANSACTIONAL
  bandwidth remaining percent 25
  random-detect dscp-based
 class BULK
  bandwidth remaining percent 10
  random-detect dscp-based
 class SCAVENGER
  bandwidth remaining percent 1
 class class-default
  bandwidth remaining percent 29
  fair-queue
  random-detect

! ---------- Parent policy: shaping ----------
policy-map WAN-SHAPE-20M
 class class-default
  shape average 20000000 200000
  service-policy WAN-QUEUING

interface GigabitEthernet0/0/0
 description WAN handoff - 20 Mbps CIR
 service-policy output WAN-SHAPE-20M

Three details in that configuration are worth calling out:

• priority percent 10 is measured against the parent shaper’s 20 Mbps, not the 1 Gbps interface — that is the entire point of the hierarchy.
• bandwidth remaining percent values apply to the 90% left after the priority queue and total 100 across the non-priority classes.
• random-detect appears only on TCP-dominant classes, never on VOICE.

Marking at the Access Edge

ip access-list extended VOICE-SIGNALING
 permit tcp any any range 2000 2002        ! SCCP
 permit tcp any any eq 5060
 permit udp any any eq 5060                ! SIP
ip access-list extended TRANSACTIONAL-APPS
 permit tcp any host 10.20.30.40 eq 1521   ! database

class-map match-any MARK-SIGNALING
 match access-group name VOICE-SIGNALING
class-map match-any MARK-TRANSACTIONAL
 match access-group name TRANSACTIONAL-APPS

policy-map ACCESS-EDGE-IN
 class MARK-SIGNALING
  set dscp cs3
 class MARK-TRANSACTIONAL
  set dscp af21
 class class-default
  set dscp default

interface GigabitEthernet1/0/12
 service-policy input ACCESS-EDGE-IN

The class-default action of set dscp default is what makes this an untrusted port: anything not explicitly recognized is re-marked to zero, so a user’s hand-set EF marking is erased.

Policing a Guest Network

policy-map GUEST-POLICER
 class class-default
  police cir 10000000 bc 12500 pir 20000000 be 25000
   conform-action transmit
   exceed-action set-dscp-transmit af11
   violate-action drop

interface Vlan50
 description Guest
 service-policy input GUEST-POLICER

The burst values come straight from the token-bucket formula, sized for a 10 ms interval:

Bc (bytes) = CIR × Tc / 8 = 10,000,000 × 0.010 / 8 = 12,500 bytes
Be (bytes) = PIR × Tc / 8 = 20,000,000 × 0.010 / 8 = 25,000 bytes

QoS Across Tunnels

When traffic is encapsulated in GRE or IPsec, the original IP header — and its DSCP — becomes payload. Two mechanisms matter:

• ToS copy — by default, IOS copies the inner DSCP into the outer tunnel header, so downstream routers can classify on the outer header without decrypting. tunnel tos overrides this with a fixed value.
• qos pre-classify — allows a service policy on the physical or tunnel interface to classify based on the inner header fields (source/destination addresses, ports) that would otherwise be hidden by encapsulation. Required whenever classification uses ACLs rather than DSCP on an encrypted path.

interface Tunnel10
 qos pre-classify

Wired QoS on Catalyst Switches

Switch QoS differs from router QoS in one fundamental way: it is implemented in hardware ASICs with a fixed number of queues and thresholds per port, not in software with arbitrary queue counts.

Platform Differences That Trip People Up

• Legacy Catalyst (3560/3750-class) — QoS is globally disabled until mls qos is entered, and while it is disabled all markings pass through untouched. Trust is set with mls qos trust dscp / mls qos trust cos. Once QoS is enabled, the default is to trust nothing, so enabling mls qos without a matching interface configuration silently zeroes out every marking.
• Catalyst 9000 (IOS-XE) — there is no mls qos command. QoS is always on, markings are trusted by default, and everything is configured with MQC. Trust is removed by applying a policy that re-marks.

Conditional Trust and Access-Port Configuration

! Catalyst 9000 / IOS-XE
interface GigabitEthernet1/0/10
 description IP phone + PC
 switchport mode access
 switchport access vlan 100
 switchport voice vlan 110
 trust device cisco-phone
 service-policy input ACCESS-EDGE-IN

! Legacy IOS equivalent
interface GigabitEthernet0/10
 mls qos trust device cisco-phone
 mls qos trust dscp

With conditional trust, the switch instructs the phone over CDP to re-mark PC traffic to CoS 0 as it passes through the phone’s internal switch, while the phone’s own voice traffic keeps EF/CoS 5. Remove the phone and trust disappears with it.

Egress Queuing on the Catalyst 9000

Catalyst 9000 ports support up to eight egress queues with three drop thresholds each, commonly deployed as 1P7Q3T (one priority queue) or 2P6Q3T (two priority queues). Queue structure is created by applying an output policy; without one, the port uses a minimal default queue set. Two platform-specific requirements catch people out: a priority class generally requires an explicit priority level, and congestion avoidance uses Weighted Tail Drop thresholds rather than WRED.

policy-map EGRESS-QUEUING
 class VOICE
  priority level 1
  police rate percent 10
 class VIDEO
  bandwidth remaining percent 30
  queue-buffers ratio 15
 class TRANSACTIONAL
  bandwidth remaining percent 25
  queue-limit dscp af23 percent 60
  queue-limit dscp af22 percent 70
  queue-limit dscp af21 percent 80
 class SCAVENGER
  bandwidth remaining percent 1
 class class-default
  bandwidth remaining percent 44

interface range GigabitEthernet1/0/1-48
 service-policy output EGRESS-QUEUING

Buffer tuning matters more on switches than on routers because the shared buffer pool is small relative to the port count. queue-buffers ratio distributes the port’s dedicated buffers between queues, and qos queue-softmax-multiplier increases how much of the shared pool a single queue may borrow — the standard first response to microburst-induced output drops.

AutoQoS

AutoQoS generates a full class-map / policy-map / interface configuration from one command, based on Cisco’s validated designs. It is a legitimate starting point and a well-known exam topic:

interface GigabitEthernet1/0/10
 auto qos trust dscp          ! trust an uplink or trusted device
 auto qos voip cisco-phone    ! conditional trust for a phone
 auto qos voip cisco-softphone

The generated configuration is ordinary MQC and can be inspected and edited afterwards with show run.

Wireless QoS

Wireless QoS is a separate problem because the medium is half-duplex and shared. There is no queue on a wire to manage; instead, stations contend for airtime, and QoS means influencing who wins that contention.

From DCF to EDCA

Under the original DCF, every station waited the same interframe space and drew a random backoff from the same contention window — all frames equal. 802.11e, certified by the Wi-Fi Alliance as WMM (Wi-Fi Multimedia), replaced this with EDCA (Enhanced Distributed Channel Access), which gives four access categories different contention parameters:

The three EDCA knobs:

• AIFSN — how many slot times a category waits before contending. Lower means faster access.
• CWmin / CWmax — the random backoff range. Smaller windows mean shorter average waits and more frequent wins.
• TXOP — how long a station may keep the medium once it wins, allowing frame bursting for video.

Note the consequence: WMM is statistical, not deterministic. Voice is more likely to win the medium, not guaranteed to.

The DSCP ↔ UP Mapping Problem

Traffic crosses between a six-bit wired marking and a three-bit wireless one twice on every round trip, and the mapping is where wireless voice quality is most often lost.

The naive mapping is “take the top three bits of DSCP” (that is, DSCP ÷ 8). Applied to EF, that produces UP 5 — AC_VI, the video category, not voice. Cisco’s implementations therefore map EF explicitly to UP 6. RFC 8325 standardizes a complete, sensible mapping for exactly this reason, including mapping network-control markings (CS6/CS7) down rather than into the highest wireless categories, since a client should never be able to claim the top category by marking CS7.

Directionally:

• Downstream (AP to client) — the AP reads the DSCP of the inner packet, maps it to a UP, and places the frame in the corresponding EDCA queue.
• Upstream (client to AP) — the client sets UP; the AP maps that to a DSCP and writes it into both the inner packet and the outer CAPWAP header, so the wired path between AP and WLC honours it.

Because the CAPWAP tunnel carries its own outer DSCP, the wired infrastructure between the AP and a centrally-switched WLC classifies on that outer value. If the switches between them do not trust DSCP, wireless voice loses its treatment on the wired path even though everything is configured correctly on both ends.

WLC QoS Profiles

AireOS controllers define four “metal” profiles, each acting as a ceiling applied per WLAN:

A profile never promotes traffic — it caps it. A WLAN left on Silver will demote EF voice to best effort no matter how correctly the phone marks its packets. This single fact explains a large proportion of “wireless voice is bad” tickets.

On the Catalyst 9800 (IOS-XE), the equivalent is MQC applied through the policy profile, which also provides per-client and per-SSID rate limiting:

policy-map GUEST-RATE-LIMIT
 class class-default
  police 5000000

wireless profile policy GUEST-POLICY
 service-policy input GUEST-RATE-LIMIT
 service-policy output GUEST-RATE-LIMIT
 no shutdown

Call Admission Control and Fastlane

• WMM Admission Control (ACM) — when the ACM bit is set for an access category, clients must request airtime with a TSPEC before using it. The AP admits or refuses based on configured airtime limits. This is genuine admission control for the RF medium, and it is what prevents call 21 from ruining calls 1 through 20.
• Cisco Fastlane / Fastlane+ — a joint Cisco/Apple capability that applies the RFC 8325-based marking maps, enables the appropriate profiles and AVC, and lets capable clients receive optimized treatment automatically instead of relying on hand-built mappings.

! Enable CAC for voice on the 5 GHz band (IOS-XE WLC)
ap dot11 5ghz cac voice acm
ap dot11 5ghz cac voice max-bandwidth 75
ap dot11 5ghz cac voice roam-bandwidth 6

Worked Examples

Example 1 — DSCP Conversion Both Ways

Q: What is AF32 in decimal and binary?
   8x + 2y  =  (8 × 3) + (2 × 2)  =  28
   28 in 6 bits = 011100
   First three bits 011 = IP Precedence 3

Q: A capture shows the ToS byte as 0xB8. What is the DSCP?
   0xB8 = 1011 1000
   DSCP = first 6 bits = 101110 = 46 = EF
   ECN  = last 2 bits  = 00 = Non-ECT

Q: DSCP 24 — which PHB?
   24 = 011000. Last three bits are 000, so it is a Class Selector.
   24 / 8 = 3  ->  CS3 (signalling)

Example 2 — Sizing the Priority Queue for Voice

Bandwidth per call must be computed at the layer the policy operates on. For G.711 with 20 ms sample sizes:

Payload per packet : 64,000 bps × 0.020 s / 8 = 160 bytes
RTP + UDP + IP     : 12 + 8 + 20              =  40 bytes
                                                ---------
IP-layer packet                                = 200 bytes
Packet rate        : 1 / 0.020                 =  50 pps

IP-layer bandwidth : 200 × 8 × 50   = 80,000 bps  = 80.0 kbps
+ Ethernet overhead (18 bytes)      : 218 × 8 × 50 = 87.2 kbps

G.729 (8 kbps codec, 20-byte payload):
IP-layer : 60 × 8 × 50  = 24.0 kbps
Ethernet : 78 × 8 × 50  = 31.2 kbps

Sizing a 20 Mbps WAN link for 30 concurrent G.711 calls plus signalling:

30 calls × 87.2 kbps  = 2,616 kbps  ≈ 2.62 Mbps
2.62 / 20             = 13.1%  ->  priority percent 14

Signalling budget: roughly 2% -> bandwidth remaining percent 2

The design guideline is that the priority queue should not exceed roughly 33% of link capacity. Beyond that, the priority traffic starves everything else so consistently that the network behaves as if it had no QoS at all — only inverted.

Example 3 — Reading show policy-map interface

Router# show policy-map interface GigabitEthernet0/0/0

 GigabitEthernet0/0/0

  Service-policy output: WAN-SHAPE-20M

    Class-map: class-default (match-any)
      48293841 packets, 39482930481 bytes
      Match: any
      Queueing
      queue limit 416 packets
      (queue depth/total drops/no-buffer drops) 0/1043/0
      shape (average) cir 20000000, bc 200000, be 200000
      target shape rate 20000000

      Service-policy : WAN-QUEUING

        Class-map: VOICE (match-any)
          8402913 packets, 1204981234 bytes
          Match: dscp ef (46)
          Priority: 10% (2000 kbps), burst bytes 50000,
          Priority Rate Limited: 0 packets

        Class-map: BULK (match-any)
          1204812 packets, 984012933 bytes
          Match: dscp af11 (10) af12 (12) af13 (14)
          Queueing
          queue limit 64 packets
          (queue depth/total drops/no-buffer drops) 12/8402/0
          bandwidth remaining 10%
            Exp-weight-constant: 9 (1/512)
            Mean queue depth: 11 packets
            class  Transmitted    Random drop    Tail drop   Minimum Maximum Mark
                   pkts/bytes     pkts/bytes     pkts/bytes  thresh  thresh  prob
            af11   904812/7.1M    102/84K        0/0         32      64      1/10
            af13   210421/1.8M    8300/6.9M      0/0         16      64      1/10

What this output establishes:

• The shaper is active at 20 Mbps and has queued (not dropped) traffic — 1,043 drops across billions of packets is healthy.
• Priority Rate Limited: 0 packets means the implicit LLQ policer has never fired, so the voice queue is correctly sized.
• DSCP-based WRED is doing exactly what it should: AF13 is being randomly dropped roughly 80× more often than AF11, and no class is tail-dropping.
• Zero counters would not mean the policy is broken — queuing statistics only increment during congestion.

Lab Exercises

These labs run on CML, EVE-NG, GNS3, or physical gear. Routers can be IOSv/CSR/Catalyst 8000v; the switch labs assume a Catalyst 9000 running IOS-XE (the 3560/3750 syntax is noted where it differs). Attempt each task before opening the answer.

Lab 1 — Classification and Marking at the Access Edge

Topology: a Catalyst switch with an IP phone and PC on Gi1/0/10 (data VLAN 100, voice VLAN 110), uplink Gi1/0/48 to a router.

Tasks:

1. Configure the access port for the phone-plus-PC pattern with conditional trust.
2. Build an ingress policy that marks SIP signalling (TCP/UDP 5060) as CS3, traffic to the application server 10.20.30.40 on TCP 1521 as AF21, and forces everything else to DSCP 0.
3. Apply the policy and verify the marks with a packet capture or by inspecting the policy counters.
4. Explain what changes if the phone is unplugged and a laptop is connected directly.

ip access-list extended SIP-SIGNALING
 permit tcp any any eq 5060
 permit udp any any eq 5060
ip access-list extended DB-APP
 permit tcp any host 10.20.30.40 eq 1521

class-map match-any SIGNALING
 match access-group name SIP-SIGNALING
class-map match-any TRANSACTIONAL
 match access-group name DB-APP

policy-map ACCESS-EDGE-IN
 class SIGNALING
  set dscp cs3
 class TRANSACTIONAL
  set dscp af21
 class class-default
  set dscp default

interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 100
 switchport voice vlan 110
 trust device cisco-phone
 service-policy input ACCESS-EDGE-IN

! Verify
show policy-map interface GigabitEthernet1/0/10
show run interface GigabitEthernet1/0/10

Lab 2 — Hierarchical Shaping with LLQ on a Sub-Rate WAN Link

Topology: R1 Gi0/0/0 is a physical 1 Gbps interface, but the carrier contract is 50 Mbps. Voice load is up to 40 concurrent G.711 calls.

Tasks:

1. Calculate the required priority bandwidth as a percentage of the contracted rate.
2. Build a child queuing policy with classes for voice, signalling, video, transactional, scavenger, and best effort.
3. Build a parent policy that shapes to 50 Mbps with a 10 ms Tc, and nest the child inside it.
4. Apply it and confirm from the running counters that the shaper — not the physical interface — is the limiting point.
5. Explain why bandwidth percent would be the wrong choice here.

! Task 1
40 calls × 87.2 kbps = 3,488 kbps ≈ 3.49 Mbps
3.49 / 50 = 7.0%  ->  priority percent 8 (rounded up for headroom)

! Task 3 burst calculation
Bc = CIR × Tc = 50,000,000 × 0.010 = 500,000 bits

! Tasks 2 and 3
class-map match-any VOICE
 match dscp ef
class-map match-any SIGNALING
 match dscp cs3
class-map match-any VIDEO
 match dscp af41 af42 af43
class-map match-any TRANSACTIONAL
 match dscp af21 af22 af23
class-map match-any SCAVENGER
 match dscp cs1

policy-map WAN-QUEUING
 class VOICE
  priority percent 8
 class SIGNALING
  bandwidth remaining percent 4
 class VIDEO
  bandwidth remaining percent 30
  random-detect dscp-based
 class TRANSACTIONAL
  bandwidth remaining percent 30
  random-detect dscp-based
 class SCAVENGER
  bandwidth remaining percent 1
 class class-default
  bandwidth remaining percent 35
  fair-queue
  random-detect

policy-map WAN-SHAPE-50M
 class class-default
  shape average 50000000 500000
  service-policy WAN-QUEUING

interface GigabitEthernet0/0/0
 service-policy output WAN-SHAPE-50M

! Task 4
show policy-map interface GigabitEthernet0/0/0
! Look for "shape (average) cir 50000000" with a non-zero queue depth
! under load, and Priority Rate Limited: 0 packets.

Lab 3 — Two-Rate Three-Colour Policing

Topology: R1 Vlan50 is a guest subnet. The policy is 20 Mbps committed, 40 Mbps peak.

Tasks:

1. Calculate Bc and Be for a 10 ms interval.
2. Configure a trTCM policer that transmits conforming traffic, re-marks exceeding traffic to CS1, and drops violating traffic.
3. Apply it inbound and generate traffic above 40 Mbps to confirm all three actions fire.
4. State what would change if this were a shaper instead, and which choice suits TCP better.

! Task 1
Bc = 20,000,000 × 0.010 / 8 = 25,000 bytes
Be = 40,000,000 × 0.010 / 8 = 50,000 bytes

! Task 2
policy-map GUEST-TRTCM
 class class-default
  police cir 20000000 bc 25000 pir 40000000 be 50000
   conform-action transmit
   exceed-action set-dscp-transmit cs1
   violate-action drop

interface Vlan50
 service-policy input GUEST-TRTCM

! Task 3
show policy-map interface Vlan50
! conformed / exceeded / violated counters should all be incrementing

Lab 4 — Congestion Avoidance with DSCP-Based WRED and ECN

Topology: the WAN edge router from Lab 2.

Tasks:

1. Add DSCP-based WRED to the transactional and bulk classes.
2. Set explicit minimum/maximum thresholds so AF23 begins dropping earlier than AF21.
3. Enable ECN marking on the bulk class.
4. Explain why WRED must never be applied to the voice class.
5. Read the WRED section of show policy-map interface and identify which counter proves WRED is working rather than the queue simply overflowing.

policy-map WAN-QUEUING
 class TRANSACTIONAL
  bandwidth remaining percent 30
  random-detect dscp-based
  random-detect dscp 18 32 64 10     ! AF21 min 32 max 64
  random-detect dscp 20 24 64 10     ! AF22 min 24 max 64
  random-detect dscp 22 16 64 10     ! AF23 min 16 max 64
 class BULK
  bandwidth remaining percent 10
  random-detect dscp-based
  random-detect ecn

Lab 5 — Switch Egress Queuing and Microburst Drops

Topology: a Catalyst 9000 access switch, uplink Gi1/0/48 showing output drops while averaging 15% utilization.

Tasks:

1. Explain how a link averaging 15% can drop packets.
2. Identify the commands that confirm the drops are on the egress queue and identify which queue.
3. Build an egress policy with a priority queue for voice, weighted classes for video and transactional, and 1% for scavenger.
4. Apply buffer tuning to reduce microburst drops.

! Task 2
show interfaces GigabitEthernet1/0/48 | include output drops
show platform hardware fed switch active qos queue stats interface Gi1/0/48
! The per-queue drop counters identify which class is losing packets.

! Task 3
policy-map EGRESS-QUEUING
 class VOICE
  priority level 1
  police rate percent 10
 class VIDEO
  bandwidth remaining percent 30
  queue-buffers ratio 15
 class TRANSACTIONAL
  bandwidth remaining percent 30
 class SCAVENGER
  bandwidth remaining percent 1
 class class-default
  bandwidth remaining percent 39

interface GigabitEthernet1/0/48
 service-policy output EGRESS-QUEUING

! Task 4
qos queue-softmax-multiplier 1200

Lab 6 — Wireless QoS End to End

Topology: a Catalyst 9800 WLC, a centrally-switched voice WLAN, and the access switch the AP connects to.

Tasks:

1. Identify every place a voice packet’s marking can be lost between a wireless phone and a wired phone.
2. Confirm WMM is required (not merely allowed) on the voice WLAN, and explain the difference.
3. Configure a policy profile with a 5 Mbps per-client rate limit on the guest WLAN.
4. Enable voice CAC on 5 GHz with a 75% airtime budget and 6% roaming reserve.
5. Explain why the AP’s switch port must trust DSCP.

! Task 3
policy-map GUEST-RATE-LIMIT
 class class-default
  police 5000000

wireless profile policy GUEST-POLICY
 service-policy input GUEST-RATE-LIMIT
 service-policy output GUEST-RATE-LIMIT
 no shutdown

! Task 4
ap dot11 5ghz cac voice acm
ap dot11 5ghz cac voice max-bandwidth 75
ap dot11 5ghz cac voice roam-bandwidth 6

! Verification
show wireless profile policy detailed GUEST-POLICY
show ap dot11 5ghz network
show wireless client mac-address <mac> detail

Verification and Troubleshooting Command Set

! Routers / IOS-XE
show policy-map                                  ! configured policies
show policy-map interface GigabitEthernet0/0/0   ! live counters (the key command)
show class-map
show interfaces GigabitEthernet0/0/0 | include drops|queue

! Catalyst switches
show mls qos                                     ! legacy: is QoS enabled?
show mls qos interface Gi0/10                    ! legacy: trust state
show mls qos maps                                ! legacy: CoS/DSCP maps
show platform hardware fed switch active qos queue stats interface Gi1/0/48
show platform software fed switch active qos policy summary

! Wireless (Catalyst 9800)
show wireless profile policy detailed <name>
show wlan id <id>
show ap dot11 5ghz network
show wireless client mac-address <mac> detail   ! per-client QoS state

! Path measurement
show ip sla statistics
show ip sla configuration

Common Mistakes and Exam Traps

• Zero counters do not mean a broken policy. Queuing acts only during congestion.
• Shaping is egress only. Policing works in both directions. This distinction is a reliable exam question.
• Policing drops; shaping delays. TCP prefers shaping; policing is for enforcement and demotion.
• CoS does not survive a router or an untagged link. Long-haul markings must be DSCP.
• Enabling mls qos on a legacy switch without setting trust erases every marking. On the Catalyst 9000 there is no such command and trust is the default.
• AF drop precedence is inverted relative to intuition. AF13 is dropped before AF11.
• The LLQ priority queue is implicitly policed. Excess EF traffic is dropped during congestion rather than allowed to starve other classes.
• Never apply WRED to a UDP or priority class.
• DiffServ has no admission control. Call 21 into a 20-call queue degrades all 21.
• A wireless QoS profile is a ceiling, never a promotion. Silver caps voice at best effort.
• The naive DSCP-to-UP mapping puts EF in the video category. RFC 8325 exists to fix this.
• QoS cannot create bandwidth. It only decides who suffers when there is not enough. A permanently saturated link needs an upgrade, not a policy.

Summary

QoS on the ENCOR blueprint reduces to a short chain of ideas. Congestion produces four measurable impairments. DiffServ addresses them by classifying traffic into a handful of aggregate classes at the edge, marking them in the DSCP field, and having every hop apply a per-hop behaviour built from six components — classification, marking, policing, shaping, queuing, and congestion avoidance — expressed through MQC’s class-map / policy-map / service-policy structure. Wired switches implement the same model with fixed hardware queues and platform-specific trust defaults; wireless implements it through EDCA access categories, DSCP-to-UP mapping, and per-WLAN profile ceilings, with CAPWAP carrying the marking across the wired path in between.

The single most valuable habit when studying this topic is to build a policy, congest the link deliberately, and read show policy-map interface until every counter in it is accounted for. Every concept above becomes concrete in that output.