County VoIP markings remain correct inside the campus, but quality collapses across the WAN after a firewall at the edge rewrites DSCP to zero. What QoS design issue does this reveal?
Select an answer to reveal the explanation.
Short Explanation
QoS sticky notes only help if nobody peels them off at the door. If the WAN-edge firewall zeros DSCP, the far side treats voice like bulk. Fix the trust boundary—preserve or remark on purpose, don’t accidentally bleach the markings.
Full Explanation
When county VoIP markings remain correct on campus but quality collapses across the WAN after an edge firewall rewrites DSCP to zero, the design issue is a misplaced trust boundary that strips markings. Preserve or intentionally remark DSCP at the WAN edge per policy so EF/AF classes survive into the provider or partner network carrying municipal voice. Blaming WMM Admission Control left enabled on guest SSIDs confuses local guest admission behavior with WAN DiffServ remarking of campus-originated packets. Claiming OFDMA cannot carry DSCP beyond the AP misstates both HE scheduling and IP QoS—DSCP lives in the IP header independent of OFDMA resource units. Requiring beacon intervals to match WAN round-trip time mixes 802.11 beacon timing with path QoS and does not restore stripped markings. Exam caveat: end-to-end QoS fails at the first device that untrusts or zeros DSCP—document trust boundaries hop by hop. Operational check: capture or probe DSCP before and after the firewall during a test call, correct trust/remark policy, and record the municipal WAN QoS contract so future firewall changes keep civic VoIP classes intact under load. In municipal WLAN operations, record the chosen control and the rejected alternatives in the change ticket so on-call staff understand which failure modes were avoided for city services. Re-validate after the next maintenance window that the same control still holds under the current controller code, client mix, and civic event calendar used by the wireless team.