Setting Up QoS for 3CX under Windows 7

Mark Berry June 2, 2011

As mentioned in the previous post, getting endpoints to apply QoS tagging is only half the battle. We also need the PBX to apply tagging on outbound packets.

My current PBX is 3CX version 9, running in a Windows 7 virtual machine.

I initially planned to use 3CX’s native DSCP tagging capability to apply tags. But that didn’t work. According to this 3CX forum thread, this is due to a limitation in Windows 7; the QoS API has been “banned.”

The recommendation is to follow this blog post to set up QoS through Policy. Sure enough, that works fine. I did modify the instructions a bit for my environment:

  • I used Group Policy rather than Local Policy, simply restricting the scope to the virtual machine running 3CX.
  • To be consistent with my endpoints, I applied DSCP 46 (Expedited Forwarding) rather than 56 as recommended in the blog post.
  • Rather than set up one policy covering all traffic from the PBX machine, I set up three policies, each one for a different 3CX executable:

    3CXMediaServer.exe covers standard RTP traffic on any port.
    3CXPhoneSystem.exe generates the SIP traffic (port 5060 by default).
    3CXTunnel.exe is used when tunneling from a 3CX softphone (port 5090).

My Group Policy looks like this:


Now all VoIP traffic inside my network is tagged with DSCP 46.

Next step would be to get calls to and from the VoIP provider to be QoS tagged. Oh, and every Internet switch between me an them to use QoS for prioritizing packets. Yeah, right. At this point, getting QoS to work beyond the firewall seems pretty unlikely for a small business on a standard DSL or cable connection.


  1. Basic QoS Setup on a Cisco SG 200 Switch | MCB Systems   |  June 02, 2011 at 2:37 pm

    […] Hooray, our switch is now prioritizing packets with DSCP 46 ahead of other traffic, and we’ve used the switch to tell the Polycom phone to add DSCP 46 to its headers (the SPA3102 was doing that already). However because we’re using an in-house PBX, that’s only half the traffic:  packets coming from the PBX to the endpoints still has DSCP 0, as do packets leaving the PBX for the router. Fixing that will be the subject of the next post. […]

  2. RaFi   |  June 03, 2011 at 9:14 am

    It is worth mentioning:

  3. Mark Berry   |  June 03, 2011 at 9:42 am

    Yes, I found that article before. However that person could not set DSCP using policy, and the answer was to circumvent the domain-joined requirement. In my case this is a domain-joined machine so applying Group Policy is not an issue and DSCP works fine when set through policy.

Leave a Reply