Quality of Service · DSCP mapping
Map DSCP values into the right WAN carrier class, MPLS EXP bits, and SD-WAN forwarding class. Outputs the Cisco table-map you need and the carrier coordination table your provider will ask for.
Your branch router marks voice as EF — great. Your carrier's PE edge ignores it and re-maps every packet to CoS 0 — not great. This tool builds the mapping table that keeps markings consistent end-to-end across MPLS, internet, and SD-WAN tunnels.
DSCP is a 6-bit field in the IP header. The carrier uses either MPLS EXP (3 bits → 8 values) or a CoS label (typically 4 or 6 classes). The tool collapses DSCP into the carrier's class structure while keeping the critical separation: voice in its own class, signaling and video protected, and everything else in best-effort.
On SD-WAN overlays, you almost always want to preserve DSCP from inner to outer so the underlay can honor it. On plain IPsec to DMVPN, the tunnel source interface has to apply the QoS policy *after* encapsulation, or traffic will be queued by its encrypted header (all the same DSCP), not by the original.
MPLS EXP is 3 bits, which means only 8 classes max end-to-end on an MPLS core. Your 8-class DSCP model has to collapse into this 3-bit space; the mapping Cisco and most carriers agree on is: EF→5, CS6→6, CS5→4, AF4x→4, CS3/AF3x→3, AF2x→2, AF1x/CS2→1, default→0.
On 802.1Q trunks to carrier CE handoffs, CoS (3 bits in the 802.1p field of the VLAN tag) is used instead of DSCP or EXP. Most Metro-E carriers police/shape based on CoS, so you need to mark CoS in addition to DSCP before the packet hits the CE switch.
match ip dscp matches on IPv4 only. match dscp matches both IPv4 and IPv6. Always use match dscp on IOS-XE 16.x and later unless you have a specific reason.
No. DSCP 40 = CS5. EF is DSCP 46. Push back — CS5 is usually broadcast video, not interactive voice. Confirm in writing which DSCP value the carrier's real-time class accepts.
Because the ESP header shows only the outer DSCP. Either trust-copy DSCP from inner to outer (the default on Cisco IOS-XE), or apply QoS before encryption using a per-tunnel policy. If the physical interface then re-queues, you're fine.
Voice EF → COS1 (Real-Time). Video AF41 → COS2 (Critical). Signaling CS3 + NetCtrl CS6 → COS2. Everything else → COS4 (Standard).
Use qos pre-classify on the tunnel interface so the pre-encryption packet is used for classification, then the physical interface's policy queues based on the original DSCP.
CoS 5 = voice, CoS 3 = video+signaling+net-ctrl, CoS 0 = everything else. Mark both DSCP (for internal) and CoS (for carrier) on egress.