Local Internet Breakout and Voice QoS Asymmetry
An enterprise has 480 branches connected by SR-MPLS to two hub sites, with BFD on all WAN links. Voice uses SIP over UDP 5060 and RTP 16384–32767; DSCP EF. After enabling local internet breakout for Microsoft 365 at 120 branches, voice MOS drops from 4.2 to 3.1 between 09:00 and 10:00. At affected branches, inbound voice arrives via the hub, but outbound RTP takes the local breakout. The branch WAN edge has a 100 Mbit/s uplink and a single 8-queue QoS profile; the ISP does not preserve DSCP. display qos queue statistics shows EF queue at 0% while BE queue is saturated. The team wants to either disable breakout or add a second local link. They need a recommendation that preserves SaaS performance without sacrificing voice quality.
1. Diagnose why voice MOS collapsed after local breakout, including the asymmetric path and QoS behavior.
Read the worked answer
Local breakout likely changed the default route for internet-bound traffic, and the voice flow became asymmetric: SIP signaling or inbound RTP still traverses the hub/MPLS, while outbound RTP follows the local ISP link. The branch QoS profile is applied to the WAN edge, but the local breakout path may not have the same shaper, trust boundary, or queue treatment. The ISP does not preserve DSCP, so EF-marked RTP is reclassified to best effort. The EF queue shows 0% because the marking was stripped or the local interface does not apply the policy; the BE queue is saturated and adds jitter and loss. MOS falls from 4.2 to 3.1 in the busy hour. Disabling breakout restores the old path but loses the SaaS benefit; adding a second local link without fixing QoS and routing will not fix asymmetry. First confirm with display qos policy interface, display traffic-policy applied-record, display qos queue statistics interface, and a traceroute for RTP ports.
2. Design a QoS and routing policy that keeps voice on the MPLS path while allowing selective SaaS breakout.
Read the worked answer
Classify voice by SIP/RTP and application, and steer it over the MPLS path in both directions while allowing only named SaaS prefixes or applications out the local breakout. Apply a trust boundary at the access switch: trust EF from IP phones, remark PC traffic, and re-mark at the WAN edge. Use a QoS profile with a strict-priority EF queue, assured forwarding for business apps, and a shaper at 90% of the 100 Mbit/s uplink on both MPLS and local breakout interfaces. Enable BFD/SLA probes on both paths and use policy-based routing with a fallback; do not let local breakout attract the default route for voice. If the business requires voice over local internet, choose an ISP that preserves DSCP or build a second link with per-path SLA and symmetric routing. Verify with MOS probes, display qos queue statistics, and per-path jitter/latency before and after cutover.