ENSDWI Part 11: QoS and Application Quality of Experience

21 July 2026 CiscoENSDWISDWAN

The second half of domain 5.0: QoS treatment on WAN Edge routers (5.4 — a “configure” line, so expect CLI and exhibit questions) and Application Quality of Experience (5.5 — “describe”). If you’ve read the QoS internals post on the Fortinet side, the concepts transfer; the vocabulary and defaults don’t, and ENSDWI tests the vocabulary.

The QoS pipeline on a WAN Edge

Order of operations for a packet leaving the service side towards a tunnel:

classify → police/mark (ingress actions) → route/tunnel → queue → schedule/shape → transmit

In Catalyst SD-WAN terms, that’s built from four objects, configured as localized policy (feature template/config group — not the centralized policy builder):

  1. class-map — maps traffic classes to one of 8 queues (0–7).
  2. Ingress classification — an access list (localized data policy) or centralized data policy sets the forwarding class; alternatively trust incoming DSCP.
  3. qos-scheduler — per queue: bandwidth percent, buffer percent, scheduling (LLQ/WRR) and drop (tail-drop / RED).
  4. qos-map — bundles schedulers, applied egress on the WAN interface.

Facts with exam weight:

  • Queue 0 is the LLQ (low-latency/priority queue) and also carries control/BFD traffic by default — starve-proof by design; user traffic mapped there shares with control. On cEdge, control traffic actually uses its own internal mechanisms, but “queue 0 = LLQ = where voice goes” is the answer pattern.
  • All other queues are WRR (weighted round robin) by bandwidth-percent.
  • Drop policy: tail drop on queue 0, RED available on 1–7.
  • Marking: set dscp (outer tunnel header rewrite is the one that matters in-fabric — remember the tunnel copies inner DSCP to outer by default, so transit QoS sees your markings; rewrite-rules adjust the outer specifically).
  • Policing = drop/remark above rate, no buffering, ingress or egress. Shaping = buffer to rate, egress only (shaping-rate on the interface, in kbps). The policer-vs-shaper contrast is a guaranteed question somewhere in any Cisco QoS blueprint.
  • cloud-qos / cloud-qos-service-side enable QoS on virtual platforms (C8000V) — recognise the keywords.

Per-tunnel QoS

Hub problem: one fat hub circuit, two hundred branches with different downstream speeds; a plain egress shaper treats them as one pool and a big branch can drown a small one. Per-tunnel QoS shapes per session/destination-branch: spokes advertise their downstream bandwidth (via OMP, from the downstream-bandwidth config), the hub instantiates a shaper+qos-map instance per spoke tunnel. Hub = “session QoS” side, spokes declare bandwidth. Know: it’s hub-to-spoke (not any-to-any), and it exists to stop inter-branch starvation at the hub.

Adaptive QoS

Per-tunnel’s cousin for DIA/broadband where the actual available bandwidth moves: the edge adjusts shaping rate dynamically between configured min/max based on measured loss (from BFD/telemetry), so the shaper tracks what the circuit can really do instead of a static number. Configure adapt period + min/max percentages on the interface. The phrase “shaping rate adjusts automatically based on WAN conditions” maps to adaptive QoS.

5.5 App-QoE

The WAN-optimisation suite, running on service-node-capable cEdges (integrated on 8300/8500 with SSD/service plane, or external CSP/service node cluster; the flow is redirected via AppNav). All describe-level:

TCP optimization

The edge acts as a transparent TCP proxy (based on WAAS lineage): splits the TCP session, applies window scaling, SACK, congestion-control improvements on the WAN leg — rescues chatty TCP over high-latency paths (satellite, intercontinental). Enabled per-VPN/policy; needs the service plane.

DRE — Data Redundancy Elimination

Byte-level deduplication with per-peer dictionaries on both ends of the overlay path: repeated byte patterns are replaced with signatures and rehydrated at the far edge. Pairs with LZ compression. Big wins on file-server/backup/replication traffic that repeats. Both edges need DRE (dictionaries are pairwise), storage-backed (hence SSD requirement).

Packet duplication

For loss-sensitive small flows (voice): send copies of each packet over multiple tunnels simultaneously; far edge dedupes and delivers the first-arriving copy. Costs bandwidth (×N paths), buys loss immunity — a 2% lossy path pair yields ~0.04% effective loss. Configured via data policy action; exam scenario: “voice must survive a lossy circuit and bandwidth is available” → duplication.

FEC — Forward Error Correction

Parity packets: for every 4 data packets, 1 parity packet rides along; the far end reconstructs a single lost packet per block without retransmission. Modes: FEC-always vs FEC-adaptive (kicks in above a loss threshold, ~2%). Cheaper than duplication (25% overhead vs 100%+), can’t survive burst loss of multiple packets in one block. Scenario discrimination — “minimise overhead while correcting sporadic loss” → FEC-adaptive; “maximum protection, bandwidth no object” → duplication.

AppNav-XE

The redirection fabric that gets flows from the forwarding path to the service node doing TCP-opt/DRE: an AppNav controller function on the edge, cluster of service nodes, flow distribution and health. Recognise the name and role; detailed AppNav design is beyond the blueprint.

Verification commands

show sdwan policy from-vsmart            ! data policy carrying FEC/duplication actions
show sdwan tunnel statistics fec         ! FEC blocks tx/rx, reconstructed packets
show sdwan tunnel statistics pkt-dup     ! duplication counters
show sdwan appqoe flow all               ! TCP-opt / DRE flows on the service node
show policy-map interface GigabitEthernet0/0/0   ! queue stats, drops per class (IOS-XE)

An exhibit showing per-queue drops on show policy-map interface with voice in a WRR queue instead of the LLQ is the canonical “find the misconfiguration” question.

Exam traps for this domain

  • 8 queues; queue 0 = LLQ + control, tail-drop; queues 1–7 WRR with RED available.
  • Forwarding class → queue via qos-map; classification happens via ACL/data policy, scheduling via qos-scheduler. Keep the object names straight.
  • Shaping buffers egress-only; policing drops/remarks either direction. Rates: shaping in kbps.
  • Per-tunnel QoS: hub shapes per spoke using spoke-advertised downstream bandwidth. Adaptive QoS: shaper follows measured circuit capacity between min/max.
  • Duplication = copies across paths (loss immunity, high overhead). FEC = parity per 4-packet block (low overhead, single-loss recovery). TCP-opt = proxy for latency. DRE = dedupe for repeated data.
  • App-QoE features need service-node capability (SSD/8300/8500/external CSP) — a C8200 branch box doing DRE is a wrong answer.

That’s domain 5.0 complete. Part 12 wraps the series: management and operations — vManage AAA, monitoring and alarms, the REST API, software image management — plus an exam-week revision plan for the whole blueprint.