We have a Cisco 871 router at our remote work at home individuals 3 in total. All these locations have standard site to site IPSEC VPN's back to a Cisco PIX 506E 6.35. Each remote has their own 7960 Cisco Phone which registers with a Call Manager at the hub location where the PIX Firewall resides. We also have a Cisco 2821 router with multiple sub's for intervlan routing purposes between voice vlan's data and mgmt. The ISP providers at each location do not pay attention to the DSCP markings nor do they offer QoS. However I have yet to see bandwidth spike above 50% usage at either location during these one way audio issues. I am trying to determine if when the Voice packets arrive at the Cisco PIX, do they still have the EF DSCP marking upon decapsulation? If the EF marking is still there do I have to trust mls qos on the switchport that uplinks to the pix or does the EF bit get wiped out and set to default, thereby putting the phone call into default queues and getting dropped?