!
! SOLUTION CONFIG — HUB-WC-1 (QoS MQC)
! Blueprint: §4.4 QoS using MQC, §3.2.a.iii Per-Tunnel QoS
!
version 17.6
service timestamps log datetime msec
service timestamps debug datetime msec
service password-encryption
no ip domain lookup
ip routing
logging buffered 64000
!
hostname HUB-WC-1-QOS
!
enable algorithm-type scrypt secret Lab@2024#EI
!
! Class maps — classification (§4.4.a.iii)
class-map match-any CM-VOICE
 description RTP voice traffic — DSCP EF
 match dscp ef
 match ip dscp 46
!
class-map match-any CM-CALL-SIGNALING
 description SIP/SCCP call control — DSCP CS3/AF31
 match dscp cs3
 match dscp af31
!
class-map match-any CM-CRITICAL-DATA
 description Business-critical apps — DSCP AF31/AF32/AF33
 match dscp af31
 match dscp af32
 match dscp af33
!
class-map match-any CM-BULK-DATA
 description Backup/FTP — DSCP AF11/AF12
 match dscp af11
 match dscp af12
!
class-map match-any CM-SCAVENGER
 description Low priority / P2P — DSCP CS1
 match dscp cs1
!
! NBAR classification for unmarked traffic (§4.4.a.iv)
class-map match-any CM-NBAR-VOICE
 match protocol rtp audio
!
! Policy map — marking at ingress (§4.4.a.v)
policy-map PM-MARK-INGRESS
 class CM-NBAR-VOICE
  set dscp ef
 class class-default
  set dscp default
!
! Policy map — CBWFQ + LLQ for DMVPN tunnel (§4.4.a.vii)
policy-map PM-DMVPN-EGRESS
 ! LLQ for voice — strict priority, 128 kbps guaranteed
 class CM-VOICE
  priority 128
 ! CBWFQ for call signaling — 10% bandwidth
 class CM-CALL-SIGNALING
  bandwidth percent 10
 ! CBWFQ for critical data — 30%
 class CM-CRITICAL-DATA
  bandwidth percent 30
  random-detect dscp-based
 ! CBWFQ for bulk data — 10%
 class CM-BULK-DATA
  bandwidth percent 10
 ! Scavenger — 1% (throttle low-priority)
 class CM-SCAVENGER
  bandwidth percent 1
 ! Best-effort gets remainder
 class class-default
  fair-queue
!
interface Tunnel0
 description DMVPN-WEST — QoS policy applied
 ip address 172.16.10.254 255.255.255.0
 tunnel mode gre multipoint
 tunnel source GigabitEthernet1
 ip nhrp network-id 10
 ip nhrp redirect
 ip nhrp map multicast dynamic
 ! Apply QoS outbound on tunnel (§3.2.a.iii per-tunnel QoS)
 service-policy output PM-DMVPN-EGRESS
 no shutdown
!
interface GigabitEthernet1
 description WAN uplink — mark ingress traffic
 ip address 10.0.210.1 255.255.255.254
 ! Mark traffic from spoke sites on ingress
 service-policy input PM-MARK-INGRESS
 no shutdown
!
end