RTP media is delay-sensitive. Packet loss, jitter and latency caused by congestion can produce broken audio, frozen video and dropped calls. QoS markings allow switches and routers to identify these packets and place them into appropriate queues before congestion occurs.

The recommended treatment is:

Why the packets should be marked at the access edge

QoS should normally be applied as close to the traffic source as possible:

1. The access switch establishes the trust boundary.
2. Packets are classified by device, VLAN, subnet, protocol or port.
3. The switch sets or validates the DSCP value.
4. The core and distribution switches trust the validated marking.
5. Each network device uses the marking to select an appropriate egress queue.

Marking packets only after they have entered the core is less effective because congestion may already have occurred on the access or distribution uplink.

DSCP and CoS perform related but different functions:

• DSCP is carried in the IP header and normally remains available across routed Layer 3 boundaries.
• CoS, also called IEEE 802.1p PCP, is carried in an IEEE 802.1Q VLAN tag. It is therefore relevant only on tagged Layer 2 links.
• The DSCP-to-CoS mapping tells a switch which Layer 2 priority to use when forwarding the packet over a VLAN trunk.

CoS values are not transported across a routed boundary. Each router or Layer 3 switch derives its local queue treatment from DSCP and creates a new Layer 2 header for the next link.

Classification considerations

RTP does not use one universal port range. The range is negotiated by the call-control system and depends on the telephone, PBX, SBC or video platform. Common ranges include:

UDP 10000-20000
UDP 16384-32767
UDP 32768-65535

The actual configured range must be taken from the relevant communications platform.

Audio and video RTP cannot reliably be distinguished solely by inspecting an RTP packet. Suitable classification methods include:

• Dedicated voice and video VLANs or subnets.
• Trusted markings from managed telephones, SBCs and video endpoints.
• Switch device profiling.
• Access control lists based on known endpoint addresses and configured media ports.
• Application-aware classification where supported.

Do not trust DSCP indiscriminately on user-facing ports. An unmanaged device could mark bulk traffic as EF and consume the priority queue. Trust should be restricted to managed telephones, SBCs, PBXs, video systems and controlled uplinks.

The following examples use:

Voice subnet:       10.10.10.0/24
Video subnet:       10.10.20.0/24
RTP port range:     UDP 16384-32767
SIP signalling:     TCP/UDP 5060 and 5061
H.323 signalling:   TCP 1720 and UDP 1719

These values must be replaced with the addressing and ports used by the actual deployment.

Cisco IOS and IOS XE example

This example classifies traffic on an access or routed interface and marks the IP packets. Cisco syntax and queuing capabilities vary significantly between Catalyst models and software releases.

ip access-list extended VOICE-RTP
 permit udp 10.10.10.0 0.0.0.255 any range 16384 32767

ip access-list extended VIDEO-RTP
 permit udp 10.10.20.0 0.0.0.255 any range 16384 32767

ip access-list extended CALL-SIGNAL
 permit udp 10.10.10.0 0.0.0.255 any eq 5060
 permit tcp 10.10.10.0 0.0.0.255 any eq 5060
 permit tcp 10.10.10.0 0.0.0.255 any eq 5061
 permit udp 10.10.10.0 0.0.0.255 any eq 1719
 permit tcp 10.10.10.0 0.0.0.255 any eq 1720
 permit udp 10.10.20.0 0.0.0.255 any eq 5060
 permit tcp 10.10.20.0 0.0.0.255 any eq 5060
 permit tcp 10.10.20.0 0.0.0.255 any eq 5061

class-map match-any VOICE-RTP
 match access-group name VOICE-RTP

class-map match-any VIDEO-RTP
 match access-group name VIDEO-RTP

class-map match-any CALL-SIGNAL
 match access-group name CALL-SIGNAL

policy-map MARK-COLLABORATION
 class VOICE-RTP
  set dscp ef
 class VIDEO-RTP
  set dscp af41
 class CALL-SIGNAL
  set dscp cs3
 class class-default
  set dscp default

interface GigabitEthernet1/0/10
 description Collaboration access interface
 service-policy input MARK-COLLABORATION

On Catalyst platforms that support the older global DSCP-to-CoS map syntax, the mapping can be configured as follows:

mls qos
mls qos map dscp-cos 46 to 5
mls qos map dscp-cos 34 to 4
mls qos map dscp-cos 24 26 to 3

For a managed telephone that already marks its packets correctly, a trusted access-port configuration may resemble:

interface GigabitEthernet1/0/10
 description Managed IP telephone
 switchport mode access
 switchport access vlan 20
 switchport voice vlan 30
 mls qos trust dscp

Trust commands are platform-specific. Some IOS XE switches use MQC policies or Auto-QoS instead of the older mls qos commands.

A WAN or constrained uplink also needs an egress scheduling policy. A representative policy is:

class-map match-any DSCP-VOICE
 match dscp ef

class-map match-any DSCP-VIDEO
 match dscp af41

class-map match-any DSCP-SIGNAL
 match dscp cs3 af31

policy-map WAN-QOS
 class DSCP-VOICE
  priority percent 10
 class DSCP-VIDEO
  bandwidth percent 30
 class DSCP-SIGNAL
  bandwidth percent 5
 class class-default
  fair-queue

interface GigabitEthernet0/0/0
 service-policy output WAN-QOS

The bandwidth percentages must be calculated from the link speed and expected call capacity. The priority queue should be policed or bounded so that excessive EF traffic cannot starve other applications.

Useful verification commands include:

show policy-map interface GigabitEthernet1/0/10
show policy-map interface GigabitEthernet0/0/0
show access-lists
show mls qos maps dscp-cos

Juniper Junos example

Junos commonly separates classification from rewriting:

• An ingress firewall filter assigns a forwarding class.
• An egress rewrite rule writes the required DSCP and IEEE 802.1p values.
• A scheduler controls the queue behaviour.

The following is a representative configuration for an EX or MX platform:

set class-of-service forwarding-classes class voice queue-num 5
set class-of-service forwarding-classes class video queue-num 4
set class-of-service forwarding-classes class signalling queue-num 3
set class-of-service forwarding-classes class best-effort queue-num 0

set firewall family inet filter CLASSIFY-COLLAB term VOICE-RTP from source-address 10.10.10.0/24
set firewall family inet filter CLASSIFY-COLLAB term VOICE-RTP from protocol udp
set firewall family inet filter CLASSIFY-COLLAB term VOICE-RTP from destination-port 16384-32767
set firewall family inet filter CLASSIFY-COLLAB term VOICE-RTP then forwarding-class voice
set firewall family inet filter CLASSIFY-COLLAB term VOICE-RTP then accept

set firewall family inet filter CLASSIFY-COLLAB term VIDEO-RTP from source-address 10.10.20.0/24
set firewall family inet filter CLASSIFY-COLLAB term VIDEO-RTP from protocol udp
set firewall family inet filter CLASSIFY-COLLAB term VIDEO-RTP from destination-port 16384-32767
set firewall family inet filter CLASSIFY-COLLAB term VIDEO-RTP then forwarding-class video
set firewall family inet filter CLASSIFY-COLLAB term VIDEO-RTP then accept

set firewall family inet filter CLASSIFY-COLLAB term SIP-UDP from source-address 10.10.10.0/24
set firewall family inet filter CLASSIFY-COLLAB term SIP-UDP from protocol udp
set firewall family inet filter CLASSIFY-COLLAB term SIP-UDP from destination-port [ 5060 5061 ]
set firewall family inet filter CLASSIFY-COLLAB term SIP-UDP then forwarding-class signalling
set firewall family inet filter CLASSIFY-COLLAB term SIP-UDP then accept

set firewall family inet filter CLASSIFY-COLLAB term SIP-TCP from source-address 10.10.10.0/24
set firewall family inet filter CLASSIFY-COLLAB term SIP-TCP from protocol tcp
set firewall family inet filter CLASSIFY-COLLAB term SIP-TCP from destination-port [ 5060 5061 ]
set firewall family inet filter CLASSIFY-COLLAB term SIP-TCP then forwarding-class signalling
set firewall family inet filter CLASSIFY-COLLAB term SIP-TCP then accept

set firewall family inet filter CLASSIFY-COLLAB term DEFAULT then forwarding-class best-effort
set firewall family inet filter CLASSIFY-COLLAB term DEFAULT then accept

Define the DSCP and IEEE 802.1p rewrite rules:

set class-of-service rewrite-rules dscp COLLAB-DSCP forwarding-class voice loss-priority low code-point 101110
set class-of-service rewrite-rules dscp COLLAB-DSCP forwarding-class video loss-priority low code-point 100010
set class-of-service rewrite-rules dscp COLLAB-DSCP forwarding-class signalling loss-priority low code-point 011000

set class-of-service rewrite-rules ieee-802.1 COLLAB-PCP forwarding-class voice loss-priority low code-point 101
set class-of-service rewrite-rules ieee-802.1 COLLAB-PCP forwarding-class video loss-priority low code-point 100
set class-of-service rewrite-rules ieee-802.1 COLLAB-PCP forwarding-class signalling loss-priority low code-point 011

Apply the classification filter to the routed ingress interface:

set interfaces ge-0/0/1 unit 0 family inet filter input CLASSIFY-COLLAB

Apply the rewrite rules to the egress interface:

set class-of-service interfaces ge-0/0/47 unit 0 rewrite-rules dscp COLLAB-DSCP
set class-of-service interfaces ge-0/0/47 unit 0 rewrite-rules ieee-802.1 COLLAB-PCP

On switched access ports, a family ethernet-switching filter or a BA classifier may be required instead. The precise syntax depends on the Junos platform and whether the interface is routed or switched.

Useful verification commands include:

show class-of-service interface ge-0/0/47
show firewall filter CLASSIFY-COLLAB
show interfaces queue ge-0/0/47
show configuration class-of-service

Aruba AOS-CX example

AOS-CX can use class and policy definitions to mark ingress traffic. The following is representative of current AOS-CX releases:

class ip VOICE-RTP
    10 match udp 10.10.10.0/24 any range 16384 32767

class ip VIDEO-RTP
    10 match udp 10.10.20.0/24 any range 16384 32767

class ip CALL-SIGNAL
    10 match udp 10.10.10.0/24 any eq 5060
    20 match tcp 10.10.10.0/24 any eq 5060
    30 match tcp 10.10.10.0/24 any eq 5061
    40 match udp 10.10.10.0/24 any eq 1719
    50 match tcp 10.10.10.0/24 any eq 1720

policy MARK-COLLABORATION
    10 class ip VOICE-RTP action dscp 46
    20 class ip VIDEO-RTP action dscp 34
    30 class ip CALL-SIGNAL action dscp 24

interface 1/1/10
    apply policy MARK-COLLABORATION in

Map the DSCP values to internal local priorities:

qos dscp-map 46 local-priority 5
qos dscp-map 34 local-priority 4
qos dscp-map 24 local-priority 3
qos dscp-map 26 local-priority 3

On a controlled uplink where markings have already been validated, DSCP trust can be enabled:

interface 1/1/48
    qos trust dscp

Local priority is used internally for queue selection. Depending on the AOS-CX model and release, the egress PCP value may be derived from the local-priority mapping or configured through an egress QoS policy. The queue profile should assign:

Local priority 5: voice queue
Local priority 4: video queue
Local priority 3: signalling queue

Useful verification commands include:

show policy MARK-COLLABORATION
show policy hitcounts MARK-COLLABORATION interface 1/1/10
show interface 1/1/10 qos
show qos dscp-map
show interface queues 1/1/48

Older ArubaOS-Switch products use different commands, commonly including:

qos dscp-map 101110 priority 5
qos dscp-map 100010 priority 4
qos dscp-map 011000 priority 3

The binary or decimal format accepted by the command depends on the ArubaOS-Switch release.

Arista EOS example

Arista EOS supports MQC-style classification and marking. A representative configuration is:

ip access-list VOICE-RTP
   10 permit udp 10.10.10.0/24 any range 16384 32767

ip access-list VIDEO-RTP
   10 permit udp 10.10.20.0/24 any range 16384 32767

ip access-list CALL-SIGNAL
   10 permit udp 10.10.10.0/24 any eq 5060
   20 permit tcp 10.10.10.0/24 any eq 5060
   30 permit tcp 10.10.10.0/24 any eq 5061
   40 permit udp 10.10.10.0/24 any eq 1719
   50 permit tcp 10.10.10.0/24 any eq 1720

class-map type qos match-any VOICE-RTP
   match ip access-group VOICE-RTP

class-map type qos match-any VIDEO-RTP
   match ip access-group VIDEO-RTP

class-map type qos match-any CALL-SIGNAL
   match ip access-group CALL-SIGNAL

policy-map type qos MARK-COLLABORATION
   class VOICE-RTP
      set dscp 46
   class VIDEO-RTP
      set dscp 34
   class CALL-SIGNAL
      set dscp 24

interface Ethernet10
   service-policy type qos input MARK-COLLABORATION

Map the DSCP values to internal traffic classes:

qos map dscp 46 to traffic-class 5
qos map dscp 34 to traffic-class 4
qos map dscp 24 to traffic-class 3
qos map dscp 26 to traffic-class 3

Where supported, map the internal traffic classes to egress CoS values:

qos map traffic-class 5 to cos 5
qos map traffic-class 4 to cos 4
qos map traffic-class 3 to cos 3

On a controlled uplink, existing DSCP values can be trusted rather than rewritten:

interface Ethernet48
   qos trust dscp

EOS QoS commands depend on the switching ASIC and software release. Some platforms use traffic-class mappings for queue selection but require a separate rewrite configuration before changing the outgoing CoS or DSCP field.

Useful verification commands include:

show policy-map interface Ethernet10
show qos interfaces Ethernet10
show qos maps
show interfaces counters queue
show ip access-lists

Operational recommendations

• Mark and validate packets at the access edge.
• Trust DSCP only from managed devices and controlled infrastructure links.
• Preserve the markings through firewalls, VPNs, WAN routers and SD-WAN appliances.
• Use EF only for real-time audio media.
• Put EF into a low-latency queue with a configured limit.
• Give AF41 video substantial bandwidth, but do not normally place all video into an unrestricted strict-priority queue.
• Give CS3 or AF31 signalling guaranteed bandwidth without prioritising it above the media.
• Confirm that the service provider preserves DSCP; many Internet and carrier services remark or discard it.
• Configure QoS consistently in both directions. Calls are bidirectional even when the signalling session was initiated from only one side.
• Size queues from the number of concurrent calls, codec bit rate and packetisation interval.
• Include IP, UDP, RTP, encryption and Layer 2 overhead when calculating bandwidth.
• Monitor class counters, queue drops, latency, jitter and packet loss after deployment.

QoS does not create bandwidth and does not improve an uncongested link. It controls which traffic is delayed or dropped when an egress interface is congested. Correct marking must therefore be paired with appropriate queue scheduling and sufficient link capacity.