This document defines the Assured Forwarding (AF) PHB group, a Differentiated Services (DS) Per-Hop Behavior (PHB) group that provides assured forwarding of IP packets in four independently forwarded AF classes. Each AF class has three drop precedence levels, and packets are marked with an AF codepoint based on their class and precedence. The AF PHB group allows providers to offer different levels of forwarding assurances for IP packets received from customers. Each AF class is allocated a certain amount of forwarding resources, and packets are assigned to classes based on the customer's subscribed services. Within each AF class, packets are marked with one of three drop precedence values. In case of congestion, the drop precedence determines the packet's priority. A congested DS node tries to protect packets with lower drop precedence values by discarding packets with higher drop precedence values. The level of forwarding assurance depends on the allocated resources, the class's current load, and the packet's drop precedence. The AF PHB group is designed to be used in both end-to-end and domain edge-to-domain edge services. Traffic conditioning actions at the domain edge can control the amount of AF traffic entering or exiting the domain. The AF PHB group's queueing and discard behavior is defined to minimize long-term congestion while allowing short-term congestion. The dropping algorithm must be insensitive to short-term traffic characteristics and treat all packets within a class and precedence level identically. The AF PHB group may be used in conjunction with other PHB groups, and the relationships between them must be documented. The AF PHB group's codepoints are recommended for general use, and they do not overlap with other PHB groups. The AF PHB group can be used to implement various services, such as the Olympic service, which consists of three classes with different levels of forwarding assurance. The AF PHB group also has security implications, and providers should limit traffic entering the domain to subscribed profiles to protect against denial of service attacks.This document defines the Assured Forwarding (AF) PHB group, a Differentiated Services (DS) Per-Hop Behavior (PHB) group that provides assured forwarding of IP packets in four independently forwarded AF classes. Each AF class has three drop precedence levels, and packets are marked with an AF codepoint based on their class and precedence. The AF PHB group allows providers to offer different levels of forwarding assurances for IP packets received from customers. Each AF class is allocated a certain amount of forwarding resources, and packets are assigned to classes based on the customer's subscribed services. Within each AF class, packets are marked with one of three drop precedence values. In case of congestion, the drop precedence determines the packet's priority. A congested DS node tries to protect packets with lower drop precedence values by discarding packets with higher drop precedence values. The level of forwarding assurance depends on the allocated resources, the class's current load, and the packet's drop precedence. The AF PHB group is designed to be used in both end-to-end and domain edge-to-domain edge services. Traffic conditioning actions at the domain edge can control the amount of AF traffic entering or exiting the domain. The AF PHB group's queueing and discard behavior is defined to minimize long-term congestion while allowing short-term congestion. The dropping algorithm must be insensitive to short-term traffic characteristics and treat all packets within a class and precedence level identically. The AF PHB group may be used in conjunction with other PHB groups, and the relationships between them must be documented. The AF PHB group's codepoints are recommended for general use, and they do not overlap with other PHB groups. The AF PHB group can be used to implement various services, such as the Olympic service, which consists of three classes with different levels of forwarding assurance. The AF PHB group also has security implications, and providers should limit traffic entering the domain to subscribed profiles to protect against denial of service attacks.