Theoretical foundations and architecture
RFC 3270 describes three QoS tunneling models for MPLS: Uniform, Pipe and Short-Pipe. The choice determines how DSCP and TC change at ingress, in transit and at egress. 1. Uniform: end-to-end transparency. At ingress the customer DSCP is mapped into the TC. If a core node changes the TC (for example raises the drop precedence), the changed value is copied back into the customer DSCP at egress, so the customer sees the effect of the core. 2. Pipe: customer isolation. The DSCP is mapped into the TC at ingress and the customer DSCP is left unchanged at egress; the egress PE schedules its queue by the TC of the label, so the TC must reach it (without PHP, for example with explicit null). 3. Short-Pipe: the most common choice for VPN services. The customer DSCP is preserved and the queue on the egress interface is chosen by the original customer DSCP, so it does not depend on core treatment and works with PHP.
Two PHB hierarchies in one packet
A customer packet in an L3VPN carries two independent priorities: the inner one (tunneled PHB), which corresponds to the customer DSCP, and the outer one (LSP PHB), which corresponds to the TC of the operator's label. RFC 3270 (section 4) names three tunneling models, that is, three answers to three questions: is the inner priority copied into the outer one at push; is the outer one passed back into the inner one at pop; and by which of the two PHBs does the egress PE queue the packet on the way out to the CE. The choice is not about performance but about the terms of the contract: does the operator change the customer DSCP, and is the customer marking part of the SLA.
Uniform: one DiffServ domain from CE to CE
At push the TC is derived from the DSCP (copy or table); transit P routers may change the TC (re-marking, mark-down on congestion or profile violation), and that change is not local: when the label is removed, the TC value is copied into the header that gets exposed, that is, into the TC of the next label or into the DSCP of the IP packet (RFC 3270). The result: an IP packet leaving toward the CE carries a DSCP determined by the core, not by the customer. The model fits when the operator and the customer form one DiffServ administrative domain: an enterprise network on MPLS, a provider backbone where user IP traffic belongs to the provider anyway, or transit between domains with a common policy. For a VPN service sold to a customer with its own QoS scheme, Uniform is harmful: the customer sees that the core rewrote its marking.
Pipe: the core is invisible, but the egress obeys it
The ingress PE assigns the TC by operator policy (by the service SLA, not by copying) and does not touch the inner DSCP; nothing is copied at pop, and the customer DSCP at the exit stays the same. But per RFC 3270 the egress LSR queues the packet by the outer PHB, that is, by the TC assigned by the operator (and possibly changed by the core), not by the customer DSCP. The point: the operator can guarantee a service class along the whole path, including the last link to the CE, regardless of what the customer wrote in the DSCP. The price: the egress PE must be able to see the TC. When PHP removes the label at the penultimate P, the TC disappears; in an L3VPN there is a way out because the VPN label stays in the stack and carries its own TC, while for single-label LSPs (IPv4 over LDP, 6PE without a VPN label) PHP must be disabled: the egress advertises explicit-null (label 0 for IPv4, 2 for IPv6, RFC 3032), and the last hop carries a label with a TC.
Short-Pipe: the core is invisible and the egress ignores it
Ingress and transit are the same as in Pipe: the TC is assigned by the operator, the DSCP is neither copied nor changed. The only difference is on the egress PE: the queue toward the CE is chosen by the inner PHB, that is, by the customer DSCP, like ordinary IP traffic. A mark-down in the core is "forgiven" on the last link: if a P lowered EF from TC 5 to TC 0 because of congestion, the customer EF still lands in the priority queue on the exit. PHP does not interfere: the egress PE receives only the VPN label (or plain IP) and classifies by DSCP anyway. This is the most common model at providers: the customer queue on the CE interface is the customer's responsibility, and the PE already knows the customer DSCP profile from ingress classification.
| Model | Ingress PE (push) | P and PHP | Egress PE: exit queue | DSCP on exit to CE | UHP needed? |
|---|---|---|---|---|---|
| Uniform | TC from DSCP | TC changes, copied down at pop | By TC (after copying it is the DSCP) | Rewritten by the core | No |
| Pipe | TC by operator policy | TC changes, not copied | By the label TC | Original customer value | Yes for LSPs without a VPN label |
| Short-Pipe | TC by operator policy | TC changes, not copied | By the customer DSCP | Original customer value | No |
The same packet in three models
The customer sent EF (DSCP 46). The ingress PE set TC 5. On P1 the profile was violated and P1 rewrote the TC to 0. From there the models differ:
| What the packet sees | Uniform | Pipe | Short-Pipe |
|---|---|---|---|
| TC in the core after P1 | 0 | 0 | 0 |
| Queue on the last link to the CE | Best Effort | Best Effort (by TC 0) | Priority (by DSCP EF) |
| DSCP on exit to the CE | 0 (lost) | 46 (preserved) | 46 (preserved) |
| Visibility of the mark-down to the customer | Visible in the DSCP | Hidden, but delay and loss are visible | Hidden, impact minimal |
What happens in each node
Ingress PE: classifies by customer DSCP/ACL and sets the TC on all labels of the stack (transport and VPN). Transit P: changes only the outer label (swap), the TC is carried over unless a policer or remark fires; a P sees neither the DSCP nor the inner label. The penultimate P at PHP removes the transport label; in Uniform it (or the egress PE) copies the TC into the exposed VPN label or IP; in Pipe and Short-Pipe nothing is copied. Egress PE: finds the VRF by the VPN label, does an IP lookup and puts the packet into the exit queue according to the rules of the chosen model. If explicit-null is configured on the PHP segment, the extra label costs 4 bytes on the last link and an additional lookup on the egress: some ASICs do it in a second pass, so explicit-null is enabled deliberately and only for LSPs without a VPN label.
