Cisco CCNP Enterprise (ENCOR 350-401) · lesson 9 of 12 · 35 min
Why QoS?
Networks carry many types of traffic simultaneously — voice calls, video conferences, database queries, file transfers, and web browsing. Without QoS, all traffic is treated equally (best-effort). A large file transfer can cause a voice call to break up. QoS gives you tools to prioritize important traffic and manage congestion. QoS is like airport security lanes. Without it, everyone waits in the same line — a family with 10 bags holds up a business traveler with a carry-on. With QoS, you have TSA PreCheck (priority queue for voice), standard lanes (normal traffic), and cargo processing (bulk transfers). Everyone gets through, but critical traffic gets through faster.
QoS Models
QoS Markings: DSCP and CoS
QoS Pipeline: The 4 Steps
Mark traffic as close to the source as possible (trust boundary). Classify and mark at the access layer. Re-mark or police at the distribution/core layer. Never trust markings from untrusted devices (end users can set DSCP themselves).
Queuing Mechanisms
LLQ is the gold standard for voice LLQ = CBWFQ + strict priority queue. Voice goes in the priority queue (police bandwidth to prevent starvation of other queues). All other traffic classes get minimum bandwidth guarantees via CBWFQ. This is the Cisco recommended QoS model for voice networks.
Policing vs Shaping
MQC: Modular QoS CLI
Cisco QoS is configured using MQC (Modular QoS CLI) with three components: class-map (classify), policy-map (define actions), and service-policy (apply to interface). MQC Structure class-map match-any VOICE → match dscp ef → exit | policy-map QOS-POLICY → class VOICE → priority 128 → class class-default → fair-queue → exit | interface GigabitEthernet0/0 → service-policy output QOS-POLICY
Flashcard Drill
DSCP EF (46) Expedited Forwarding — used for voice traffic. Requires low latency, low jitter, low loss. LLQ Low Latency Queuing = CBWFQ + strict priority queue. Voice goes in priority queue, other classes get bandwidth guarantees. Trust boundary The point where you trust or re-mark QoS markings. Mark at the access layer; don’t trust end-user device markings. Policing Drops or re-marks excess traffic immediately — no delay added. Used for inbound rate limiting. Shaping Buffers excess traffic and sends it later — smooths bursts but adds delay. Used for outbound WAN rate matching. WRED Weighted Random Early Detection — drops packets probabilistically before queue fills. Prevents TCP synchronization. CBWFQ Class-Based Weighted Fair Queuing — assigns minimum bandwidth guarantees per traffic class using MQC. CoS (802.1p) Layer 2 QoS marking in 802.1Q VLAN tag — 3 bits (0-7). Lost when frame is routed (Layer 3 boundary). DSCP AF41 (34) Assured Forwarding 4-1 — used for interactive video (Cisco recommendation).
Knowledge Check — 12 Questions
QoS: Classification, Marking & Queuing
Which DSCP value is recommended for voice traffic?
- AF41 (34)
- CS3 (24)
- EF (46)
- BE (0)
Answer: EF (46)
EF (Expedited Forwarding, DSCP 46) is the standard marking for voice traffic — it requires low latency, low jitter, and low loss.
What is the key difference between LLQ and CBWFQ?
- LLQ supports more traffic classes
- LLQ adds a strict priority queue for voice on top of CBWFQ
- CBWFQ is faster
- LLQ uses DSCP; CBWFQ uses CoS
Answer: LLQ adds a strict priority queue for voice on top of CBWFQ
LLQ = CBWFQ + strict priority queue. The priority queue is always served first, guaranteeing low latency for voice.
What does policing do to traffic that exceeds the configured rate?
- Buffers it and sends later
- Drops or re-marks it immediately
- Queues it in a priority queue
- Increases the rate limit
Answer: Drops or re-marks it immediately
Policing drops or re-marks excess traffic immediately — no buffering, no delay added.
What does shaping do to traffic that exceeds the configured rate?
- Drops it immediately
- Re-marks it with lower DSCP
- Buffers it and sends it later
- Sends it to a scavenger queue
Answer: Buffers it and sends it later
Shaping buffers excess traffic and releases it at the configured rate — smooths bursts but adds delay and jitter.
The three MQC components are class-map, policy-map, and _____.
Answer: service-policy
MQC uses class-map (classify traffic), policy-map (define QoS actions), and service-policy (apply to an interface).
Where should QoS markings be applied in a network?
- At the core layer
- As close to the source as possible (access layer)
- At the WAN edge only
- At the destination
Answer: As close to the source as possible (access layer)
Mark traffic at the trust boundary — as close to the source as possible. This ensures consistent treatment throughout the network.
Which QoS marking is a Layer 2 field in the 802.1Q VLAN tag?
- DSCP
- IP Precedence
- CoS (802.1p)
- MPLS EXP
Answer: CoS (802.1p)
CoS (Class of Service) is a 3-bit field in the 802.1Q VLAN tag — it is a Layer 2 marking and is lost when a frame is routed.
What is WRED and what problem does it solve?
- A queuing mechanism that prioritizes voice
- A congestion avoidance tool that drops packets probabilistically before the queue fills
- A marking tool that sets DSCP values
- A policing mechanism for WAN links
Answer: A congestion avoidance tool that drops packets probabilistically before the queue fills
WRED (Weighted Random Early Detection) drops packets before the queue fills, preventing TCP global synchronization where all flows back off simultaneously.
Which QoS model uses RSVP for per-flow bandwidth reservations?
- DiffServ
- Best-effort
- IntServ
- MPLS QoS
Answer: IntServ
IntServ (Integrated Services) uses RSVP to reserve bandwidth for individual flows. It doesn’t scale to large networks.
What DSCP value is used for scavenger (low-priority bulk) traffic?
- EF (46)
- AF41 (34)
- CS1 (8)
- BE (0)
Answer: CS1 (8)
CS1 (DSCP 8) is used for scavenger traffic — low-priority bulk transfers that should be dropped first during congestion.
In MQC, which component applies the QoS policy to an interface?
- class-map
- policy-map
- service-policy
- qos-map
Answer: service-policy
service-policy applies the policy-map to an interface in either the input or output direction.
Shaping introduces delay and jitter because it buffers excess traffic.
- True
- False
Answer: True
Shaping buffers excess traffic and releases it at the configured rate — this smooths bursts but adds delay and jitter, which is why policing is preferred for voice traffic.
Previous lesson: Wireless architecture: WLC, CAPWAP, FlexConnect, roaming (L2/L3), RRM
Back to Cisco CCNP Enterprise (ENCOR 350-401)
Next lesson: Network security: AAA (RADIUS/TACACS+), 802.1X, MACsec, CoPP, control plane protection