27 Quality of Service · CCNA

Exam topics covered

4.7 Explain the forwarding per-hop behavior (PHB) for QoS, such as classification,

marking, queuing, congestion, policing, and shaping

Foundation. One network now carries phone calls, video meetings, business applications, backups and someone's software update, all competing for the same links. Most of the time there is room for everything. But whenever traffic arrives faster than a link can send it, something must wait and something may be thrown away. Quality of Service (QoS) is the set of tools that decides what waits and what is dropped, so that a voice call stays clear while a file download slows slightly. The CCNA blueprint asks you to explain QoS rather than configure it in depth, so this chapter concentrates on the concepts: the problems QoS solves, how traffic is classified and marked, and what each per-hop tool (queuing, congestion avoidance, policing and shaping) does. A short Modular QoS CLI (MQC) example ties the ideas to real configuration. Output shown is illustrative of IOS 15 and IOS XE.

27.1 Why QoS Is Needed

Congestion happens wherever traffic converges or link speeds change. In Figure 27-1, dozens of hosts on gigabit access links feed a router whose WAN circuit is only 100 Mbps. When the combined demand exceeds 100 Mbps, even for a few milliseconds, packets queue in the router's egress buffer. A queue adds delay; a queue that grows and shrinks adds variation in delay; and a full queue drops packets.

Wan

egress queue on G0/0 fills:

delay, jitter and drops

Figure 27-1 A speed mismatch and traffic aggregation create a congestion point at the WAN edge.

QoS describes the treatment a flow needs with four characteristics:

Bandwidth: the capacity available to a flow, in bits per second.

Delay (latency): the one-way time from sender to receiver, made of serialization, propagation, processing and queuing delay. Only queuing delay is something QoS can reduce.

Jitter: the variation in delay between packets of the same flow. Voice and video endpoints use a jitter buffer to smooth it, but a large jitter means late packets are discarded anyway. Loss: the percentage of packets that never arrive, usually dropped from full queues.

Table 27-1 Typical targets for real-time traffic (widely cited Cisco design guidance) Traffic One-way delay Jitter Loss Bandwidth

Tcp

Takes what is available

27.1.1 Traffic characteristics

Voice is smooth and benign: small packets at a constant rate, carried in RTP over UDP, very sensitive to delay, jitter and loss, and never retransmitted. Video is bursty and greedy: frame sizes vary, bandwidth needs are large, and loss shows up as frozen or pixelated images. Data is usually TCP-based and elastic: TCP retransmits lost segments and slows down when it detects loss, so most data applications tolerate delay and some loss, although interactive business applications still need reasonable response times. QoS works by giving each of these classes the treatment it needs, instead of first come, first served.

27.2 The QoS Toolkit and Per-Hop Behavior

In the DiffServ (Differentiated Services) model used by virtually all networks, every device makes its own forwarding decision for each packet based on a marking in the packet. The treatment a device applies is called its per-hop behavior (PHB). Because each hop acts independently, the markings must be applied consistently and the devices along the path configured consistently. Figure 27-2 shows where each tool acts inside a device. Ingress Egress (only matters when congested)

ACL, NBAR, DSCP drop / re-mark excess CBWFQ, LLQ WRED rate limit to CIR Classification and marking happen as close to the source as possible; later hops simply trust the marking. Queuing, dropping and shaping happen at the egress interface where congestion occurs.

Figure 27-2 The QoS tools in the order a packet meets them.

27.3 Classification and Marking

Classification identifies which class a packet belongs to. A device can classify on almost anything: an ACL matching addresses and ports, the ingress interface, NBAR (Network-Based Application Recognition, which inspects payloads to recognize applications), or an existing marking. Deep classification is CPU-intensive, so it is done once, near the edge, and the result is recorded in the packet as a marking. Every later device classifies cheaply by reading that marking.

27.3.1 Layer 2 marking: CoS

The 802.1Q tag contains a 3-bit Priority Code Point (PCP) field, usually called Class of Service (CoS), with values 0 to 7 (Figure 27-3). Voice is normally CoS 5. The weakness of CoS is that it exists only in the 802.1Q tag: it is lost on access ports (untagged frames) and whenever a router rebuilds the frame. Layer 3 markings survive end to end.

Dest MAC Source MAC 802.1Q tag Type Data FCS
TPID 0x8100 (16 bits) PCP (3) DEI (1) VLAN ID (12 bits)
CoS 0–7 (voice = 5)

Figure 27-3 The 3-bit PCP field in the 802.1Q tag carries the CoS value.

27.3.2 Layer 3 marking: IP Precedence and DSCP

The second byte of the IPv4 header was originally the Type of Service (ToS) byte, whose first three bits were IP Precedence (0 to 7). DiffServ redefined the byte as the DS field: the first six bits are the Differentiated Services Code Point (DSCP), values 0 to 63, and the last two bits are used for Explicit Congestion Notification (ECN). IPv6 has the same 8-bit layout in its Traffic Class field. Because DSCP's first three bits occupy the same positions as IP Precedence, the two are backward-compatible (Figure 27-4).

Version (4) IHL (4) ToS / DS field (8) Total Length (16) ... rest of IPv4 header IP Precedence (3 bits) other ToS bits (3) unused (2)

DSCP (6 bits, values 0–63) ECN (2)
Original:
DiffServ:

Example: EF = 101110 binary = DSCP 46; its first three bits (101) equal IP Precedence 5

Figure 27-4 The same byte read as IP Precedence (3 bits) or as DSCP (6 bits) plus ECN.

Rather than use arbitrary numbers, DiffServ defines standard PHB names with recommended DSCP values (Table 27-2):

Default (DF), DSCP 0: best effort.

Expedited Forwarding (EF), DSCP 46: low delay, low jitter, low loss; used for voice. Assured Forwarding (AF): four classes (AF1x to AF4x), each with three drop precedence values. AFxy means class x, drop precedence y, and its decimal DSCP is 8x + 2y. Within a class, higher drop precedence is discarded first when congestion builds: AF13 before AF12 before AF11.

Class Selector (CS0–CS7): DSCP = 8 × n, chosen so the first three bits equal IP Precedence n, for backward compatibility.

Table 27-2 DSCP values: AF classes, EF and class selectors

Know these numbers cold: EF = 46 for voice, AF41 = 34 for interactive video, CS3 = 24 for call signaling, DF = 0 best effort, and the AF formula 8x + 2y. CoS is 3 bits in the 802.1Q header; DSCP is 6 bits in the IP header; IP Precedence is the first 3 bits of the same byte.

27.3.3 Trust boundaries

Any host can mark its own packets, so a user could mark a file transfer as EF and jump the queue. The trust boundary is the point in the network where you start believing markings. Outside it, markings are ignored or rewritten; inside it, devices trust what they receive. Best practice is to place it as close to the source as possible. With Cisco IP phones, the access switch extends trust to the phone (detected via CDP), which marks its own voice EF/CoS 5 and re-marks traffic from the PC attached behind it to 0 (Figure 27-5).

L3
PC IP phone Access switch Distribution
Trust boundary
Untrusted Trusted: markings honored hop by hop
PC marks its traffic DSCP 46
phone re-marks it to CoS 0 / DSCP 0
Phone voice: CoS 5 / DSCP EF (46); signaling CS3
Switch: mls qos trust device cisco-phone (conditional trust)

Figure 27-5 The trust boundary extended to the IP phone. Markings from the PC are not trusted.

27.4 Queuing (Congestion Management)

When packets arrive for an interface faster than it can transmit, they wait in a queue. Queuing tools decide how many queues exist, which packets go into which queue, and how a scheduler chooses the next packet to send. Queuing only matters during congestion; when the link is idle, packets leave immediately.

FIFO (first in, first out): one queue, no differentiation. A voice packet waits behind every data packet that arrived before it.

Round robin / weighted round robin: several queues served in turn, optionally weighted so some get more turns. Fair, but a voice packet may still wait for every other queue's turn.

Class-Based Weighted Fair Queuing (CBWFQ): one queue per class defined by the administrator, each with a guaranteed minimum bandwidth (in kbps or percent) during congestion. Unused bandwidth is shared by others. Good for data and video, but no queue gets absolute priority, so delay and jitter are not bounded.

Low Latency Queuing (LLQ): CBWFQ plus a strict-priority queue. The scheduler always empties the priority queue first, so voice gets minimal delay and jitter. To prevent the priority queue from starving everything else, it is policed to its configured rate during congestion; excess priority traffic is dropped.

Figure 27-6 LLQ: a strict-priority queue for voice plus CBWFQ classes with bandwidth guarantees. The scheduler always serves the priority queue first.

Exam alert

LLQ is the recommended queuing for voice and real-time video because it gives a strict-priority queue. CBWFQ alone guarantees bandwidth but not low delay. The priority queue is policed so that it cannot starve the other queues.

27.5 Congestion Avoidance

A queue has finite length. When it is full, newly arriving packets are discarded: tail drop. Tail drop treats all packets alike and has a nasty side effect on TCP. When a queue overflows, packets from many TCP sessions are dropped at the same moment, so all of them shrink their windows at once, the link goes under-utilized, then all ramp up together and overflow the queue again. This cycle is TCP global synchronization (Figure 27-7). Tail drop also hurts with TCP starvation: non-adaptive UDP flows keep sending and fill the queue while TCP flows back off.

Figure 27-7 TCP global synchronization: tail drops hit every flow at once (blue = total, green = one flow), wasting capacity after each drop.

Random Early Detection (RED) avoids this by dropping a few packets before the queue is full. As the average queue depth passes a minimum threshold, RED begins discarding a small, increasing fraction of packets at random, so only some TCP sessions slow down at any moment. Above the maximum threshold, everything arriving is dropped (full drop). Weighted RED (WRED), Cisco's implementation, uses different thresholds per marking, so lower-priority traffic is dropped earlier. With DSCP-based WRED, AF13 starts dropping before AF12, which drops before AF11 (Figure 27-8). WRED is applied to TCP-based classes; it does not help UDP voice and is never used on the priority queue.

average queue depth
drop probability
100%

Mpd

Figure 27-8 WRED drop profiles. Higher drop precedence (AF13) has lower thresholds and is discarded first.

27.6 Policing and Shaping

Both tools enforce a rate, typically a committed information rate (CIR). They differ in what they do with traffic that exceeds it (Figure 27-9).

A policer measures traffic and acts immediately on the excess: it drops it or re-marks it to a lower class (for example AF11 to AF13) so it is dropped first if congestion occurs later. There is no buffering, so policing adds no delay, but the drops cause TCP retransmissions. Policers can be applied inbound or outbound. Service providers police customer traffic at the provider edge to the contracted rate; enterprises police scavenger traffic or limit a class.

A shaper buffers the excess and sends it later, smoothing bursts down to the CIR. It adds delay and jitter but avoids drops as long as its buffer has room. Shaping works only outbound. The classic use: an enterprise router with a 1 Gbps physical interface buys a 200 Mbps service, and shapes to 200 Mbps so the provider's policer never drops its traffic. QoS queuing can then be applied inside the shaped rate.

Policing: excess dropped or re-marked

Cir

time
excess
Shaping: excess buffered, sent later

Cir

time

Grey dashed: offered traffic · Solid: traffic after the tool

Figure 27-9 A policer clips traffic above the CIR; a shaper delays it, stretching each burst out at the CIR.

Both tools measure rate with a token bucket: tokens are added at the CIR, and each byte sent spends a token. The bucket size is the committed burst (Bc), which together with the CIR sets the time interval Tc = Bc / CIR over which the rate is measured. Within each interval, traffic may be sent at the physical line rate until Bc is used up; that is why even shaped traffic leaves in small bursts.

Table 27-3 Policing versus shaping

Feature Policing Shaping
Excess traffic Dropped or re-marked Buffered and delayed
Direction Inbound or outbound Outbound only
Effect on delay and
jitter
None added Adds delay and jitter

Effect on TCP Drops trigger retransmissions Smoother, fewer drops Typical location Provider edge (ingress), limiting a

class
Customer edge toward a sub-rate WAN
service

Exam alert

Policing drops (or re-marks) and works in either direction; shaping queues and works only outbound. If a question mentions a provider dropping traffic above the contract rate, the provider is policing and the customer should shape.

27.7 Modular QoS CLI

Cisco IOS configures all of these tools with the Modular QoS CLI (MQC), three building blocks:

1. class-map: classifies, matching traffic by DSCP, ACL, NBAR protocol and so on ( match-any or match-all ).
2. policy-map: lists classes and the action for each: set dscp , priority , bandwidth , police , shape , random-detect , fair-queue . Unmatched traffic falls into class-default.
3. service-policy: applies a policy map to an interface, input or output . ! 1. Mark at the edge: voice RTP from the voice VLAN subnet becomes EF

R1(config)# ip access-list extended VOICE-RTP
R1(config-ext-nacl)# permit udp 10.10.20.0 0.0.0.255 any range 16384 32767
R1(config)# class-map match-any MARK-VOICE
R1(config-cmap)# match access-group name VOICE-RTP
R1(config)# policy-map LAN-IN
R1(config-pmap)# class MARK-VOICE
R1(config-pmap-c)# set dscp ef
R1(config)# interface GigabitEthernet0/1
R1(config-if)# service-policy input LAN-IN
! 2. Queue at the WAN edge using the markings
R1(config)# class-map match-any VOICE
R1(config-cmap)# match dscp ef
R1(config)# class-map match-any VIDEO
R1(config-cmap)# match dscp af41
R1(config)# class-map match-any CRITICAL
R1(config-cmap)# match dscp af21
R1(config)# policy-map WAN-EDGE
R1(config-pmap)# class VOICE
R1(config-pmap-c)# priority percent 20 ! LLQ, policed to 20% when congested
R1(config-pmap)# class VIDEO
R1(config-pmap-c)# bandwidth percent 30 ! CBWFQ guarantee
R1(config-pmap)# class CRITICAL
R1(config-pmap-c)# bandwidth percent 20
R1(config-pmap-c)# random-detect dscp-based ! WRED
R1(config-pmap)# class class-default
R1(config-pmap-c)# fair-queue
R1(config)# interface GigabitEthernet0/0
R1(config-if)# bandwidth 100000 ! percentages are of 100 Mbps
R1(config-if)# service-policy output WAN-EDGE

If the physical interface is faster than the service bought from the provider, a parent policy shapes to the contract rate and nests the queuing policy inside it, for example policy-map SHAPE-100M , class class-default , shape average 100000000 , service-policy WAN-EDGE . Verify any policy with show policy-map interface (Figure 27-10).

R1# show policy-map interface GigabitEthernet0/0 output

Priority: 20% (20000 kbps), burst bytes 500000, b/w exceed drops: 0 Class-map: VIDEO (match-any)

(queue depth/total drops/no-buffer drops/flowdrops) 0/3120/0/3120 Fair-queue: per-flow queue limit 16 packets

Figure 27-10 Voice is served from the priority queue with no drops; the drops occur in class-default, exactly as intended.

LAB Read and Trace a QoS Policy

Goal: trace how R1 treats four packets with the policies in Section 27.7. Topology: IP phones and PCs on R1 G0/1 (voice VLAN 10.10.20.0/24); R1 G0/0 is a 100 Mbps WAN link. Use a simulator that supports MQC (CML or a physical ISR) to confirm with counters.

Figure 27-11 Lab topology and where each policy is applied.

Steps:

1. Configure the class maps and policies from Section 27.7 and apply them.
2. Predict the result for each packet: (a) RTP from 10.10.20.15 to UDP port 20000; (b) a video call already marked AF41 by the endpoint; (c) an HTTPS download marked 0; (d) a PC on the data VLAN marking its own traffic EF.
3. Generate traffic (or an extended ping with "Type of service" set to 184, which is DSCP 46 shifted left two bits) and watch show policy-map interface g0/0 output . Expected results: (a) is marked EF on G0/1 and enters the priority queue on G0/0; (b) keeps AF41 and uses the 30% CBWFQ class; (c) lands in class-default with fair queuing; (d) is still EF because LAN-IN only adds markings. To enforce a trust boundary, add a final class class-default with set dscp default to LAN-IN, so only the voice subnet keeps EF. Recheck the counters: the PC's packets now increment class-default. Chapter review

Nbar

CoS / PCP

IP Precedence

Dscp

EF
AF
CS
trust boundary

Cbwfq

Llq

tail drop

TCP global synchronization

Wred

policing

shaping

Cir

Review questions

1. What is the maximum one-way delay generally recommended for VoIP?

A. 50 ms
B. 150 ms
C. 300 ms
D. 500 ms

2. Which term describes the variation in delay between packets of a flow?

A. Latency
B. Jitter
C. Serialization
D. Loss

3. How many bits make up the DSCP field, and where is it carried?

A. 3 bits in the 802.1Q tag
B. 3 bits in the IP header
C. 6 bits in the IP header
D. 8 bits in the 802.1Q tag

4. Which DSCP value is recommended for voice bearer traffic?

A. AF41 (34)
B. CS3 (24)
C. EF (46)
D. CS6 (48)

5. Which two statements about AF markings are true? (Choose two.)

A. AF13 is dropped before AF11 during congestion
B. AF31 has decimal value 26
C. AF classes are used for voice
D. AF41 has a higher drop precedence than AF42
E. AF values use the 802.1Q PCP field

6. Where is the CoS marking carried?

A. ToS byte of IPv4
B. Traffic Class of IPv6
C. PCP field of the 802.1Q tag
D. MPLS label

7. What is a trust boundary?

A. The edge of the routing domain
B. The point where markings start to be accepted
C. The interface where shaping is applied
D. The firewall between inside and outside

8. Which queuing method provides a strict-priority queue suitable for voice?

A. FIFO
B. CBWFQ
C. LLQ
D. WRED

9. What problem does WRED address?

A. Voice jitter
B. TCP global synchronization caused by tail drop
C. Duplicate DSCP markings
D. Unequal link speeds

10. Which two statements describe traffic shaping? (Choose two.)

A. It buffers excess traffic
B. It can be applied inbound
C. It is applied outbound
D. It never adds delay
E. It re-marks excess packets

11. A provider drops customer traffic above 50 Mbps on a 1 Gbps access link. Which tool is the provider using, and which should the customer use?

A. Shaping; policing
B. Policing; shaping
C. LLQ; CBWFQ
D. WRED; marking

12. In MQC, which command applies a policy to an interface?

A. class-map
B. policy-map
C. service-policy
D. match

13. Which two actions can a policer take on traffic that exceeds the configured rate? (Choose two.)

A. Drop it
B. Buffer it for later
C. Re-mark it
D. Fragment it
E. Move it to the priority queue

Answers

1. B. 150 ms one-way is the widely cited target for good voice quality.
2. B. Jitter is delay variation; latency is the delay itself.
3. C. DSCP is the first 6 bits of the IPv4 DS field (or IPv6 Traffic Class). CoS is 3 bits in 802.1Q.
4. C. EF (46). AF41 is interactive video, CS3 call signaling, CS6 network control.
5. A, B. Higher drop precedence drops first; AF31 = 8×3 + 2×1 = 26. AF41 has lower drop precedence than AF42.
6. C. CoS is the 3-bit PCP in the 802.1Q tag.
7. B. Inside the trust boundary, received markings are honored.
8. C. LLQ adds a strict-priority queue to CBWFQ.
9. B. WRED drops selectively before the queue is full, avoiding synchronized TCP back-off.
10. A, C. Shaping queues excess traffic, adds delay and is outbound only.
11. B. The provider polices; the customer shapes to 50 Mbps so traffic is delayed rather than dropped.
12. C. service-policy input|output applies a policy map.
13. A, C. Policers drop or re-mark; buffering is shaping.