Skip to content
Log in Sign up My account

1.4 Interpreting QoS Configurations

Blueprint 1.4: Interpret QoS configurations

The verb is interpret. Expect to be shown an MQC configuration or show policy-map interface output and asked what happens to a given packet. You must read configs fluently, not write them from memory.

The QoS toolkit

Tool Purpose Direction MQC keyword
Classification Identify traffic In or out class-map, match
Marking Write a value into the header (DSCP, CoS) Usually in, at the trust boundary set dscp, set cos
Policing Enforce a rate by dropping or re-marking excess. No buffering. In or out police
Shaping Delay excess traffic in a buffer to smooth it to a rate Out only shape average
Queuing Decide which packets leave first during congestion Out only priority, bandwidth
Congestion avoidance Drop early and randomly before queues fill (WRED) Out random-detect

Trust boundary: the point where the network starts believing the markings it receives. Usually the access switch port (trusting an IP phone, not the PC behind it).

Markings you must know

Name DSCP Binary Typical use
EF 46 101110 Voice bearer
AF41 34 100010 Interactive video
CS4 32 100000 Real-time interactive
AF31 26 011010 Multimedia streaming
CS3 24 011000 Call signalling
AF21 18 010010 Transactional data
AF11 10 001010 Bulk data
CS1 8 001000 Scavenger
CS6 48 110000 Network control (routing protocols)
Default (BE) 0 000000 Best effort

Assured Forwarding formula: AFxy = DSCP 8x + 2y. Class x is 1 to 4 (higher is better treatment), drop precedence y is 1 to 3 (higher is dropped first). AF43 = 32 + 6 = 38. Class Selector: CSn = 8n, backward compatible with IP Precedence n.

Layer 2 marking is CoS: 3 bits in the 802.1Q tag, values 0 to 7, only present on trunks. Voice is CoS 5.

Reading MQC: three building blocks

class-map match-any VOICE            ! match-any = OR, match-all = AND (default)
 match dscp ef
class-map match-all SIGNALING
 match dscp cs3
class-map match-any CRITICAL-DATA
 match access-group name ERP-SERVERS
 match dscp af21
!
policy-map WAN-EDGE
 class VOICE
  priority percent 10                ! LLQ: strict priority, policed to 10% under congestion
 class SIGNALING
  bandwidth percent 5                ! CBWFQ minimum guarantee
 class CRITICAL-DATA
  bandwidth percent 30
  random-detect dscp-based           ! WRED using DSCP drop precedence
 class class-default
  fair-queue
  bandwidth percent 25
!
interface GigabitEthernet0/0/0
 service-policy output WAN-EDGE      ! attach: input or output

How to read it:

  1. A packet is checked against classes in the order they appear in the policy-map. First match wins.
  2. match-any means any one match line is enough. match-all (the default) needs every line to match.
  3. Anything that matches no class lands in class-default.
  4. priority makes a Low Latency Queue (LLQ): always served first, but during congestion it is policed to its rate so it can't starve other classes. Excess priority traffic is dropped, not queued.
  5. bandwidth is a minimum guarantee during congestion (CBWFQ). With no congestion, any class can use more.
  6. QoS queuing only acts when the interface is congested. Policing and shaping act whenever the rate is exceeded.

Policing vs shaping

policy-map POLICE-GUEST
 class class-default
  police cir 10000000 bc 312500
   conform-action transmit
   exceed-action drop
!
policy-map SHAPE-TO-50M-PARENT
 class class-default
  shape average 50000000            ! 50 Mbps, buffers excess
  service-policy WAN-EDGE           ! child policy queues inside the shaped rate
Policing Shaping
Excess traffic Dropped or re-marked Buffered and sent later
Adds delay No Yes
Direction In or out Out only
TCP behaviour Sawtooth from drops Smoother
Typical place Ingress from a customer, scavenger limits Egress to a provider with a sub-rate circuit

Single-rate three-color policer: conform-action, exceed-action, violate-action with CIR and two buckets (Bc, Be). Two-rate three-color: police cir X pir Y (RFC 2698).

The hierarchical (parent/child) policy above is the classic sub-rate WAN pattern. A 1 Gbps port connected to a 50 Mbps service never congests locally, so queuing would never kick in. The parent shaper creates artificial congestion at 50 Mbps, and the child queues inside it.

Exam trap

If a question shows a priority or bandwidth policy on a gigabit interface to a slow provider circuit with no shaper, the answer is usually that the queuing never takes effect because the interface itself isn't congested.

Reading the output

R1# show policy-map interface GigabitEthernet0/0/0 output
 GigabitEthernet0/0/0

  Service-policy output: SHAPE-TO-50M-PARENT

    Class-map: class-default (match-any)
      1203344 packets, 941234567 bytes
      queue limit 208 packets
      (queue depth/total drops/no-buffer drops) 0/1840/0
      shape (average) cir 50000000, bc 200000, be 200000

      Service-policy : WAN-EDGE

        Class-map: VOICE (match-any)
          84210 packets, 16842000 bytes
          Match: dscp ef (46)
          Priority: 10% (5000 kbps), burst bytes 125000, b/w exceed drops: 12

        Class-map: CRITICAL-DATA (match-any)
          ...
          (queue depth/total drops/no-buffer drops) 0/1203/0

What it tells you: the parent shapes to 50 Mbps; voice gets 10% of the shaped rate (5 Mbps), not of the gigabit link; 12 voice packets were dropped because voice exceeded its priority rate during congestion; critical data saw 1203 drops, so either the class is undersized or WRED is working.

Other things you may be asked to interpret

mls qos trust dscp                  ! older Catalyst: trust DSCP on this port
trust device cisco-phone            ! trust only if CDP sees a Cisco phone
auto qos voip cisco-phone           ! generates a whole QoS config
!
class-map match-all NBAR-WEBEX
 match protocol webex-media         ! NBAR2 application recognition

On Catalyst 9000 switches, ports trust DSCP and CoS by default; on older Catalyst 3750/3560 with mls qos enabled, ports were untrusted by default and re-marked everything to 0.

Lab: build, load and read a policy

Topology: R1 to R2 over one link, plus a host behind each router (or use IP SLA probes as traffic).

  1. Apply SHAPE-TO-50M-PARENT with the WAN-EDGE child to R1's link toward R2. Change the shaper to shape average 2000000 so you can congest it easily.
  2. Generate marked traffic. On R1 run an extended ping (type ping with no arguments), answer y to Extended commands, and set Type of service to 184 (ToS 184 = DSCP 46, EF), repeat count 100000, size 1400, timeout 0. Run a second extended ping with ToS 0 from another session at the same time.
  3. Read show policy-map interface and find: matches per class, priority drops, and default class drops.
  4. Swap priority percent 10 for bandwidth percent 10 and repeat. Note what changes in the counters.

Quick check

What DSCP value is AF32, and is it dropped before or after AF31?

8 x 3 + 2 x 2 = 28. Drop precedence 2 is dropped before AF31 (precedence 1) in the same class when WRED acts.

A policy has class VOICE with priority 1000 and congestion occurs. Voice is offered at 1500 kbps. What happens?

1000 kbps is sent with strict priority. The excess 500 kbps is dropped by the LLQ's implicit policer.

Class A uses match-all with match dscp af41 and match access-group 101. A packet marked AF41 does not match ACL 101. Which class does it go to?

Not class A, because match-all needs both conditions. It goes to the next class it matches, or to class-default.

References

  • QoS: Modular QoS CLI Configuration Guide, Cisco IOS XE (search "Modular QoS CLI IOS XE" on cisco.com, under your platform's configuration guides)
  • Cisco Enterprise QoS Solution Reference Network Design Guide (search on cisco.com)
  • RFC 4594 (DiffServ service classes), RFC 2597 (AF), RFC 3246 (EF)
  • Cisco Live On-Demand Library: search "QoS design"