In that case, I recommend using DSCP markings.
First create a top level policy limiting the bandwidth to the actual circuit capacity. This example is for a 50Mb/s circuit. This goes on Gig0/0/1.
policy-map pm-Gi001
class class-default
shape average 50000000
service-policy pm-QoS
Then a sub-policy. This is a generic QoS policy I use.
policy-map pm-QoS
class cm-qos-voice
priority percent 33
class cm-qos-call-signalling
bandwidth percent 5
class cm-qos-critical-data
bandwidth percent 36
class cm-qos-scavenger
bandwidth percent 1
class class-default
bandwidth percent 25
fair-queue 512
queue-limit 1024 packets
Now the class definitions for our network wide QoS policy.
class-map match-any cm-qos-voice
match ip dscp ef
class-map match-any cm-qos-scavenger
match ip dscp cs1
class-map match-any cm-qos-critical-data
match ip dscp cs6
match ip dscp af21 af22
match ip dscp cs2
class-map match-any cm-qos-call-signalling
match ip dscp cs3
match ip dscp af31
Now on your DMVPN tunnel tell it preserve/copy the QoS marking so we can process it after encapsulation.
interface Tunnel 0
qos pre-classify
Now we can QoS process traffic weather it is Internet traffic, DMVPN traffic, or anything else that flows through this interface.
Anything that you put into cm-qos-scavenger can use all free bandwidth, but is the first to get discarded. So great for large file transfers, replication, etc.
Business critical traffic, aka your traffic, should go into cm-qos-critical-data. You can mark this on the switch interfaces that kit is plugged into, or mark it as it enters the lan side interface on the router. For example, for vlan1:
access-list 101 permit ip any 10.255.0.0 0.255.255.255
access-list 101 permit ip any 10.255.4.0 0.255.255.255
access-list 101 permit tcp any 174.128.1.0 0.255.255.255 eq 80
access-list 101 permit tcp any 174.128.1.0 0.255.255.255 eq 443
class-map match-all cm-mark-vlan1
match access-group 101
policy-map pm-mark-vlan1
class cm-mark-vlan1
set ip dscp af21
