Lab 18 — QoS on DMVPN — DSCP Classification, LLQ, and Shaping

Active Nodes

Active routers: SPK-WC-1, SPK-WC-2, SPK-WC-3, HUB-WC-1

Key Concepts

QoS on Tunnel Interfaces

Service policies on physical WAN interfaces do NOT apply to GRE-encapsulated traffic by default. The policy must be applied to Tunnel0 directly. However, shaping on the physical interface feeds the tunnel — shape the physical interface to the actual CIR of the WAN link, then apply CBWFQ/LLQ on the tunnel. Without shaping, bursts exceed the line rate before queuing engages, causing packet loss before QoS queues can prioritize.

DSCP Marking and Trust Boundary

DSCP (Differentiated Services Code Point) is a 6-bit field in the IP ToS byte. Marking at the trust boundary (spoke edge) ensures DSCP values are set correctly before entering the network. Common DSCP values: EF (46) for voice, AF41 (34) for video, AF31 (26) for critical data, CS3 (24) for call signaling, BE (0) for best-effort. The NBAR protocol classification engine can mark traffic based on application type without relying on source ports.

Hierarchical QoS on DMVPN

HQoS applies a parent policy (shaping) and child policy (CBWFQ/LLQ) in a parent-child relationship. The parent policy-map shapes to the WAN CIR; the child policy-map allocates the shaped bandwidth among queues. This is necessary for DMVPN because without the parent shaper, the child LLQ does not know the total available bandwidth and cannot correctly allocate percentages. Use service-policy shape PARENT-SHAPER on Gi0/0 and reference the child policy within the parent.

HQoS Configuration

SPK-WC-1Hierarchical QoS — shaping + CBWFQ/LLQ

class-map match-all VOICE
 match dscp ef
class-map match-all VIDEO
 match dscp af41
class-map match-all CRITICAL
 match dscp af31
class-map match-all CALL-SIGNAL
 match dscp cs3

policy-map CHILD-QOS
 class VOICE
  priority percent 20
 class VIDEO
  bandwidth percent 30
 class CRITICAL
  bandwidth percent 25
 class CALL-SIGNAL
  bandwidth percent 5
 class class-default
  fair-queue

policy-map PARENT-SHAPER
 class class-default
  shape average 10000000
  service-policy CHILD-QOS

interface GigabitEthernet0/0
 service-policy output PARENT-SHAPER

Verification

show policy-map interface GigabitEthernet0/0

Expected: Hierarchical output showing parent shaper stats (tokens, queue depth) and child class stats per class. Drops in voice class should be zero under design load.

show policy-map interface Tunnel0

Expected: If policy also applied to tunnel, shows per-class packet/byte counts. Verify voice gets strict priority (LLQ).

show ip nhrp traffic

Expected: NHRP request/reply counters show normal operation. High NHRP Resolution Request counts indicate frequent spoke-to-spoke shortcut establishment.

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.