Qos on Fortigate and IPSEC VPN

DSCP tagging in a encapsulated tunnel does no good imho, but you have a few items to contend with

1: are you wanting QoS as in  layer3 header marking mixups

or

2: are you wanting traffic-prioritizing for VoIP vrs other traffic that resides in the tunnel ?

For #1,  if you want to mangle and mixup the  DCSP/TOS values in the ip_header just do it at the fwpolicy.

check out my blog post on how you could do that;

http://socpuppet.blogspot...te-tosdscp-markup.html

If you want to prioritize traffic which is probably  better overall, deploy a traffic-shaper with the high queue

config firewall policy 

    edit  < your  traffic policy for the  VOIP >           

        set traffic-shaper <SHAPE1>

         or

        set per-ip-shaper <SHAPE1>

 next

Inside   SHAPE1 you could do something simple just  like setting the priority-queue  for high

e.g

config firewall shaper traffic-shaper

    edit "SHAPE1"

        set priority high

    next

end

And now when that's applied at the fwpolicy level the  PQ high would apply before medium and low.

Alternative, You could use a combination of TOS/DSCP and values and set  PQ for those values or assign queues.

e.g

config system dscp-based-priority

    edit 1

        set ds 46

        set priority high

    next

end

That would define EF as high priority queue.

YMMV but you have many options.

Ken