QoS Architecture in Service Provider Networks

What it is

QoS architecture is the set of design choices that decide how a provider treats customer traffic of different importance.

The provider core is shared. The design must decide whose markings are trusted, how markings travel across the MPLS core, and how bandwidth is reserved for important classes.

This page covers the architecture and the models. The configuration of classification, policing and shaping is in the Services chapter.

How it works

The models answer where the marking comes from at each point of the path.

DiffServ and IntServ

DiffServ marks each packet with a code point, the DSCP, in the IP header. Every router applies a per hop behaviour (PHB) for that class. No per flow state is kept, so it scales well.

IntServ reserves resources for each flow with RSVP before the traffic is sent. Every router on the path keeps state for each flow. This does not scale to a large core, so providers use DiffServ.

Trust boundaries

The trust boundary is the point where the provider stops believing the markings it receives. For most enterprise customers, the boundary sits at the ingress PE.

At that point the provider classifies traffic and often re-marks it into its own classes. It may also police each class to the rate in the service agreement. Inside the core, markings are then trusted.

MPLS QoS tunnel models

When a packet enters an MPLS tunnel, the IP DSCP is copied or mapped into the TC bits of the label. The three models decide what happens at the far end.

• Uniform: the customer and provider form one DiffServ domain. A marking change in the core is visible to the customer at the exit.
• Pipe: the provider keeps its own marking, and the customer DSCP is never changed. The egress PE applies the provider's PHB, which suits a provider that must enforce its class at the egress. The label must still be present at the egress PE for this, so the penultimate router does not remove it.
• Short Pipe: like Pipe, but the egress PE applies the customer's PHB based on the DSCP. This is the usual choice for a managed VPN service where the customer expects its own markings to count.

In Short Pipe the label is normally removed by the penultimate router, so the egress PE sees the IP header.

RP/0/RP0/CPU0:PE1(config)# policy-map CUST_IN
RP/0/RP0/CPU0:PE1(config-pmap)# class VOICE
RP/0/RP0/CPU0:PE1(config-pmap-c)# set mpls experimental imposition 5

That is IOS XR. It sets the TC bits on the label that is added at the ingress PE, whatever the DSCP was.

MPLS TE QoS

DiffServ aware traffic engineering (DS-TE) reserves bandwidth per class, not just in total. Traffic is split into class types, and each class type has its own share of the link.

Two bandwidth constraint models decide how the shares interact:

Once several tunnels exist to the same destination, something has to put the traffic into the right one. CBTS (class based tunnel selection) and PBTS (policy based tunnel selection) pick the tunnel by the traffic class of the packet. This lets voice use a low latency tunnel while data uses another.

IPv6 flow label

The IPv6 header has a 20 bit flow label. A source can set the same label on all packets of one flow.

Routers can use it to share load across equal paths without looking deeper into the packet, which keeps the flow in order. It is not a QoS marking. IPv6 QoS uses the traffic class field, which holds the DSCP.