QoS for VoIP means telling every device you control, the switches, the Wi-Fi and the firewall or router at the edge, to recognize voice traffic and send it first when a link is busy. Done properly it has four parts: identify voice, mark it, queue it ahead of everything else, and shape outbound traffic so congestion happens on your equipment rather than the carrier's. It costs almost nothing in bandwidth, and on a shared connection it is the most useful single setting for call quality.
If you are already hearing choppy audio, start with our VoIP call quality troubleshooting guide, which shows how to work out whether the fault is your network, the circuit or the provider. This article is the setup companion: how to design QoS from the start so the problem does not appear in the first place.
Why voice needs priority at all
A phone call is a steady stream of small packets, commonly 50 a second in each direction, each carrying 20 milliseconds of audio. If a packet arrives late, the phone cannot wait for it; it plays a gap or a guess. So voice is hurt by delay, by variation in delay (jitter) and by lost packets, all explained in latency, jitter and packet loss. Bandwidth matters far less. A call on the common G.711 codec needs roughly 90 kbps each way including overhead.
Trouble starts when something bulky shares the link: a cloud backup, a large attachment, a video upload, a software update landing on 30 laptops at once. Without QoS, voice packets wait in the same line as those big transfers. With QoS, they go to the front.
The four parts of QoS, in order
1. Classify: decide what counts as voice
Voice has two kinds of traffic. Media is the audio itself, usually RTP over a range of UDP ports. Signaling sets up and ends calls, usually SIP. Your phone provider publishes the ports and address ranges its service uses. Classify by those, by the voice VLAN the phones sit on, or by markings the phones apply themselves. Avoid shortcuts such as "all UDP", which sweeps in games, video and anything else that happens to use it.
2. Mark: label the packets
The standard label is a DSCP value in each packet's IP header. The widely used convention looks like this:
| Traffic | DSCP value | Name | Typical treatment |
|---|---|---|---|
| Voice media | 46 | EF (Expedited Forwarding) | Strict priority queue, with a cap |
| Call signaling | 24 or 26 | CS3 or AF31 | A guaranteed share, above ordinary data |
| Video calls | 34 | AF41 | A guaranteed share, below voice |
| Everything else | 0 | Best effort | Whatever capacity is left |
| Backups and bulk transfers | 8 | CS1 (scavenger) | Spare capacity only |
On wired Ethernet there is also a class of service value in the 802.1p field for the local link, with voice commonly set to 5. Most business switches map between the two automatically, but check that the mapping matches the table above.
3. Queue: act on the labels
Marking does nothing on its own. Every switch port, access point and router interface that can get busy needs a queueing policy that reads the marks. Voice goes into a priority queue that is always served first. Signaling and video get a guaranteed share. Everything else shares what remains.
Cap the priority queue. A long-standing rule of thumb is to keep it to roughly a third of the link or less. If too much traffic goes into the priority queue, nothing is really prioritized any more, and a misbehaving application marked EF can starve everything else on the link.
4. Shape: make the queue form where you control it
This is the step most often missed, and the troubleshooting guide explains it in detail. In short, if your router sends at full line rate, the queue builds inside the carrier's equipment, which ignores your rules. Shape outbound traffic to slightly below the circuit's real upload speed, measured rather than advertised, and your priority rules get the chance to work.
Where QoS works, and where it does not
- Your LAN: fully under your control, across switches, the voice VLAN and Wi-Fi.
- Your upload to the carrier: under your control, provided you shape.
- Your download from the carrier: only partly. The queue for incoming traffic sits at the carrier's end. Some routers can slow incoming bulk traffic so the senders back off, which helps, but it is less precise than shaping outbound.
- The public internet: generally not. Most networks ignore or reset your DSCP marks, which is why the quality of the circuit itself still matters.
- Private networks: MPLS and some carrier Ethernet services can honor classes of service end to end, when you buy them that way.
SD-WAN adds another tool. It measures jitter and loss on two or more connections and moves calls to the cleaner one as conditions change, which helps when no single circuit is clean all day. See SD-WAN for how we price it.
The voice VLAN and the trust boundary
Putting phones on their own VLAN makes every other step easier. The switch knows anything on that VLAN is voice, the firewall can apply its own policy to it, and broadcast chatter from laptops stays out of the way. Most business switches can tell an IP phone which VLAN to use automatically through a discovery protocol such as LLDP-MED, so a phone plugged in anywhere lands in the right place. If a computer plugs in through the phone, the switch can still keep the two streams separate.
Decide whose markings you trust. Trusting the marks set by your desk phones is reasonable. Trusting whatever a laptop says is not, because any software can mark its own traffic EF. Most well-run networks re-mark traffic from untrusted ports and keep marks only from phones and known servers.
Softphones and meeting apps
Desk phones usually mark their own traffic. Softphones and meeting apps are less predictable. Some mark correctly, some only when told to, and on Windows the operating system may not apply an application's markings unless a policy allows it. The practical options are a policy on managed computers that marks traffic from the calling app, or classification on the network using the provider's published ports and address ranges. Microsoft and other large platforms publish recommended port ranges and markings for this purpose. Whichever you choose, confirm it with a packet capture from a real test call instead of assuming.
QoS on Wi-Fi
Wi-Fi has its own priority scheme, Wi-Fi Multimedia (WMM), with a voice category that gets earlier access to the airwaves. Most business access points map DSCP marks to those categories, but check the mapping. Priority on the air only helps if there is enough airtime to go round, so coverage where people actually take calls and enough access points to share the load still matter. Our comparison of access points and mesh covers the design side.
A worked example
Hypothetical: the office, circuit and traffic below are invented to show the method.
A 25-person accounting office has a cable service with 300 Mbps down and 30 Mbps up, 25 desk phones, and a nightly backup that runs into the morning during busy season. Calls break up when it does.
- The phones move onto a voice VLAN, assigned automatically by the switches, which trust markings from the phones only.
- The firewall shapes the upload to 27 Mbps, about 90% of the measured speed, with four classes: EF for voice media, capped at 5 Mbps; CS3 for signaling; best effort; and CS1 for the backup server.
- At peak, 12 simultaneous calls need roughly 1.1 Mbps each way, well inside the cap.
- Test calls are made while the backup runs flat out. A packet capture confirms voice leaves the firewall marked EF and in the priority queue.
Call quality during the backup now matches call quality without it. The backup takes a little longer. No bandwidth was bought.
Common mistakes
- Marking voice but never building a queue that reads the mark.
- Configuring the firewall but not the switches or access points, or the other way round.
- Skipping shaping, so the queue still forms at the carrier.
- Shaping to the advertised speed rather than the measured one.
- Trusting every device's markings.
- Putting voice, video and signaling all in the priority queue.
- Never testing under load. QoS that has not been tested while the link is full has not been tested.
When QoS is not enough
QoS rearranges the capacity you have. It cannot fix a circuit that drops packets on its own, an upload too small for your calls plus essential data, or a poor path to your provider. If the line itself is the problem, the answer is a better primary connection, a second connection for failover, or both. Voice-heavy offices often move to dedicated internet access, which gives a consistent upload and an SLA, or pair a shared fiber primary with a backup from a different network.
Questions to ask your phone provider
- Which ports and address ranges does your service use for signaling and media?
- Do your phones and apps mark their traffic, and with which DSCP values?
- Which codecs do you use, and how much bandwidth per call should we plan for?
- Do you recommend turning off SIP ALG on our firewall?
- Can you see jitter and packet loss per call from your side?
Phones, circuit and network from one agent
QoS works best when the people who sell you the phones and the people who sell you the circuit are talking to each other. FiberX prices business voice and UCaaS and the circuits underneath across several carriers, and our managed network service can configure and look after the switches, Wi-Fi and firewall. Carriers pay FiberX, so there is no markup, and our lowest-price promise applies. The consultation is free, you usually hear back the same day, and Phil Morales is your one point of contact. Get in touch, call 478-758-8091 or text (347) 870-0965.
