Controller Based WLANs

AP does the DSCP tagging for the outer GRE header based on the WMM AC of the incoming frames in tunnel mode. In tunnel mode since controller does the encryption/decryption, AP will not be able to see the IP DSCP values and thus cannot copy them to the outer GRE header. So for any upstream packet, the outer IP header will be set with the DSCP value from the WMM-DSCP mapping corresponding to the incoming frame's WMM_AC. However when this packet leaves the controller, if there is an ACL to set TOS, this will be applied.