Implementing DSCP Marking and QoS Policies for Voice Traffic on Enterprise Firewalls

Overview

This guide explains how to design, mark, and enforce Quality of Service (QoS) policies for SIP signaling and RTP media streams on enterprise firewalls. You will learn how to identify real-time voice traffic, map DiffServ Code Points (DSCP), configure egress queuing, and prevent bufferbloat on congested WAN links. Master these techniques to ensure crisp audio quality and reliable call control across your network infrastructure.

Key takeaways

• Use DSCP EF (46) for RTP voice media to ensure strict priority queuing and low latency.
• Assign DSCP CS3 (24) or AF31 (26) to SIP call control signaling to prevent registration drops and call setup timeouts.
• Establish clear trust boundaries at the ingress interface to remark untrusted endpoints and prevent DSCP spoofing.
• Implement egress traffic shaping and Low Latency Queuing (LLQ) to guarantee bandwidth and eliminate bufferbloat.
• Validate DSCP markings end-to-end using packet capture tools like tcpdump or Wireshark.

Prerequisites

• Basic understanding of IP networking, SIP, and RTP protocols.
• Administrative access to enterprise firewall or router CLI/GUI (e.g., FortiGate, Palo Alto, or Cisco ASA).
• Command-line access to network diagnostic tools (tcpdump, iperf3, Wireshark).

Guide

1. section #1

   Understanding DSCP Values for VoIP Traffic Voice over IP requires strict performance parameters: less than 150ms total one-way delay, under 30ms jitter, and less than 1% packet loss. To meet these targets, DiffServ Code Points (DSCP) classify IP packets at Layer 3 inside the Type of Service (ToS) header byte. RTP audio streams must be assigned Expedited Forwarding (EF, DSCP 46 / hexadecimal 0xB8) to receive strict priority treatment across network hops. SIP signaling traffic, while less sensitive to jitter, requires guaranteed delivery to avoid call failures; it is commonly tagged with Class Selector 3 (CS3, DSCP 24) or Assured Forwarding 31 (AF31, DSCP 26).

2. section #2

   Establishing Trust Boundaries and Ingress Remarking Enterprise firewalls should not implicitly trust DSCP markings coming from unmanaged endpoints, softphones, or external WAN interfaces. Rogue applications can tag non-critical bulk data with DSCP EF to bypass rate limits. To secure the trust boundary, configure ingress firewall rules to inspect source subnets, VLANs, or ports (such as UDP 5060/5061 for SIP and dynamic UDP ports for RTP) and explicitly remark packets. If packets originate from trusted hardware IP phones or Session Border Controllers (SBCs), the firewall can honor existing DSCP tags; otherwise, untrusted traffic must be re-classified and rewritten before routing.

3. section #3

   Designing Egress Queuing and Traffic Shaping QoS policies are primarily enforced on egress interfaces where high-speed internal LAN traffic funnels into lower-speed WAN or internet links. Without queuing controls, micro-bursts of data traffic saturate interface buffers, causing bufferbloat and packet drops for concurrent voice streams. Firewalls address this using Low Latency Queuing (LLQ) or Strict Priority Queuing (PQ) combined with Traffic Shaping. The voice queue is allocated a dedicated strict priority path up to a calculated maximum rate (e.g., 100 kbps per G.711 call including overhead), while remaining bandwidth is allocated to standard data classes using Weighted Fair Queuing (WFQ).

4. section #4

   Implementation Example: FortiOS CLI Configuration On a FortiGate firewall, QoS is configured by creating bandwidth profiles, traffic shapers, and shaping policies. First, define a guaranteed and maximum bandwidth shaper for voice media and signaling. Next, apply DSCP remarking and assign the traffic to high-priority queues in the shaping policy rules based on voice port ranges or application control signatures.

   config firewall shaper traffic-shaper
       edit "Voice-Priority-Shaper"
           set per-policy enable
           set priority high
           set guaranteed-bandwidth 1000
           set maximum-bandwidth 5000
       next
   end
   
   config firewall service custom
       edit "SIP-Signaling"
           set category "VOIP"
           set udp-portrange 5060-5061
       next
       edit "RTP-Media"
           set category "VOIP"
           set udp-portrange 10000-20000
       next
   end
   
   config firewall shaping-policy
       edit 1
           set service "RTP-Media"
           set traffic-shaper "Voice-Priority-Shaper"
           set class-id 2
           set diffservcode-forward 101110
           set diffserv-forward enable
       next
   end

5. section #5

   Mapping Layer 2 CoS to Layer 3 DSCP When voice traffic travels across Ethernet switches before reaching the enterprise firewall, Layer 2 802.1p Class of Service (CoS) tags are used within VLAN tags (802.1Q). Standard VoIP deployments assign CoS 5 to voice media and CoS 3 to call control. Enterprise firewalls bridging LAN VLANs to WAN circuits must maintain or map these Layer 2 CoS markings to corresponding Layer 3 DSCP values (CoS 5 -> DSCP EF, CoS 3 -> DSCP CS3). If the firewall terminates trunk sub-interfaces, verify that CoS-to-DSCP trust is explicitly enabled on the sub-interface configuration to prevent stripping VLAN tags prior to L3 classification.

6. section #6

   Verification and Monitoring with CLI Tools Once QoS policies and DSCP markings are applied, validate packet header flags using CLI diagnostics or network taps. Run tcpdump on the firewall interface to capture live RTP and SIP packets, inspecting the ToS byte in the IP header. In hex, DSCP EF (46) shifted left by 2 bits appears as 0xb8 in the ToS field, while DSCP CS3 (24) appears as 0x60. Additionally, evaluate interface queue stats to confirm that packets are traversing the high-priority egress queues without drop tail errors during peak traffic periods.

   # Capture packets on WAN interface and inspect ToS byte (0xb8 = DSCP EF 46)
   tcpdump -i eth0 -nn -v -c 10 "udp and (ip[1] = 0xb8)"
   
   # Capture SIP packets marked with CS3 (DSCP 24 -> ToS 0x60)
   tcpdump -i eth0 -nn -v -c 10 "port 5060 and (ip[1] = 0x60)"
   
   # Check firewall egress queue stats on Linux-based firewalls
   tc -s qdisc show dev eth0

Further reading

• RFC 2474: Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers
• RFC 3246: An Expedited Forwarding PHB (Per-Hop Behavior)
• RFC 4594: Configuration Guidelines for DiffServ Service Classes
• NIST Special Publication 800-58: Security Considerations for Voice Over IP Systems