DMVPN Hub Router QoS

Question

Hello DMVPN Experts,
As we knew DMVPN Hub routers can have per-tunnel QoS configuration for the spokes.
But I am not sure the QoS configuration for the Hub site itself. I assume it should be seperated from the per-tunnel QoS and the service-policy should be applied at the physical WAN interfaces and tunnel interfaces? Need help please. Some sample configuration would be appreciated.
Thanks
Cedar

Answer 1

Hi Joseph,
I am afraid I am having a bit difficulty to understand and would like to hear more if you don't mind.
We are on the same page that Per-Tunnel QoS let the spokes to control the traffics toward the hub site, which is considered inbound traffic from the WAN/Tunnel interfaces of hub router point of view. However, in order to control the inbound and/or outbound traffic of the WAN/Tunnel interfaces of the hub router, how should we configure seperate QoS configuration other than Per-Tunnel QoS templates, if we should? 
Here is what I know so far based on ASR1000 document.
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-3s/asr1000/sec-conn-dmvpn-xe-3s-asr1000-book/sec-conn-dmvpn-per-tunnel-qos.html
Restrictions for Per-Tunnel QoS for DMVPN
• The class default shaper with the QoS service policy on a physical interface that is applied to the DMVPN tunnel does not support point-to-point generic routing encapsulation (GRE) tunnels, shaper on physical interfaces, and shaper on VLAN/subinterfaces.
• QoS on a physical interface is limited only to the class default shaper on the physical interface. No other QoS configurations on the physical interface are supported when two separate QoS policies are applied to the physical and tunnel interfaces.
• Addition of a QoS policy with a class default shaper on a physical interface is not supported when multiple QoS policies are utilized.
• You can attach a per-tunnel QoS policy on the tunnel only in the egress direction.
• The class default shaper policy map on the main interface must be applied before the tunnel policy map is applied.
• The class default shaper policy map must contain only the class class-default and shape commands.
• The main interface policy map is checked for validity only when a QoS service policy is applied on the tunnel interface. The main interface policy map is not checked during a tunnel move or modification.
• Adding new classes or features to the main interface policy map is not supported. Doing so, however, will not be blocked.
After reading the above document, my understanding is that
1. We could have seperate policy map for physical WAN interface.
2. The policy-map for the physical WAN interface is limited to a class default shaper only.
3. The policy-map for physical WAN interface must be applied at the physical WAN interface before the tunnel policy-maps are applied at the tunnel interface.
But I am not 100% sure if it's correct.
Thanks,
Cedar