@GIdenJoe But there is no way to identify traffic flow based on the pair of IPs - source and destination?    I understand how to do QoS on spokes towards the hub, but is it possible to do QoS on hub and match traffic with source IP x.x.x.x destined to IP y.y.y.y (LAN segment behind the spoke)? How can I tell hub to perform QoS for traffic coming from some DC app and destined for LAN segment? Full tunnel is used.  ... View more