How to configure QoS trust boundary on Cisco Switches

[ReneMolenaar]

Hi Abhishek,

This tells us the queueing that the interface supports.

You can find some examples here, for the 6500 series:

Network Switches, LAN and Enterprise Switches

For example:

1p3q4t

Means there is one priority queue, three normal queues and four drop thresholds per queue.

Rene

[wilder7bc (Brian C)]

Thanks Rene,

I ended up getting this done. I did not realize on my first touching of QoS that MQC and MLS was two different ways of approaching the same and just a difference in switch model and moving form old to new. I found that out later and it was like a aaaaaahhhhhhh! moment.

I appreciate you replying. I got the cisco setup with MQC and every sense the phones are working much better. we use brocade for our access switches and we got most of those setup.

I do have a problem now on the brocade using the lldp med policy command.

on our branch office brocade switches in Denmark they did not separate the voice and data its all on the same vlan and they insist on leaving it that way since its under 50 people even after I tried to push for creating a new VLAN for voice.

So the VLAN is untagged.

from the documentation

Here the full document:

Support Documents and Downloads

we found the following command:

For untagged traffic

Syntax:[no] lldp med network-policy application application type untagged dscp 0-63 ports ethernet port-list | all

however if you look at it there is nothing listed for layer two prioritization now as a studious but inexperienced network Engineer jumping into QoS related topics can be a little tough.

on Tagged traffic it was not a problem because the tagged command had the priority on it:

For tagged traffic
Syntax: [no] lldp med network-policy application application type taggedvlan vlan ID priority 0-7
dscp 0-63 ports ethernet port-list | all

I opened a ticket with Brocade support but just stick to the guide and do not have an answer so I have requested the question go to a brocade design engineer since they don’t know.

Anyway to me if the untagged lldp med policy command does not effect layer 2 which is what this switch is doing and what the priority porition does then its a waste to add it.

not sure if you would happen to know anything on this lol ;0) if not Its cool but if you had an idea that’s very cool.

[wilder7bc (Brian C)]

sorry Dordrecht not Denmark I guess that’s in the Netherlands. Now that I am doing networking I will be taking my first trip out of the USA and I will have to travel to all these branch offices all over Europe. Norway, France, Itally, Netherlands and more so that’s going to be a big experience to me as well as I basically was just a country boy from the US that’s never really been anywhere lol. My world geography knowledge is crappy I am going to have to get better at it.

[ReneMolenaar]

Hi Brian,

MQC is much easier to configure than MLS. It’s a good thing Cisco is moving towards MQC and getting rid of MLS…

About your branch office, they are probably scared that making changes is going to break some things? If it’s all in the same VLAN, then there is no way that you can differentiate your traffic on L2…it’s all the same.

You could however differentiate based on L3 information. You could tag all RTP traffic for example, or do this based on the port numbers. Your IP phones are probably also tagging the DSCP field in your IP packets.

If not, you can still do this on a switch or on the router. You can then configure a priority queue for all L3 tagged IP packets.

Visiting all these european countries sounds pretty cool. There’s a lot to see here and each country is very different! Have fun

[wilder7bc (Brian C)]

@andrew

“mls qos trust device cisco-phone” will not result in traffic being trusted sent by the PC attached to the phone. You need to follow it up with
(config-if)#switchport priority extend trust

By default, when traffic is sent by a PC attached to the phone, the switchport port will reset this to the default CoS value (usually zero, unless you have configured it otherwise). By the way, if you aren’t running CDP on the switch, this will also happen, even if you have configured the first two commands I mentioned. The reason is that the switch depends on CDP to identify the Cisco-phone properly.

–Andrew

Ok I am back to this area of the forum as well again. I am going through all my boson 11 simulators and doing one on sitting up Qos on an interface and switch connected to cisco iP phone and using the MLS syntax.

funny now that I look back over my old post and cringe because while I may still be ignorant of a lot I was even more ignorant before lol…

Anyway to my questions.

1. is Switch port priority exclusive to cisco phone? I am use to switchport being a interface command so seems odd this command would only have to deal with cisco ip phone and not just the interface in general but that’s kind of what I got from your explanation.

2. depending on how you answer 1 this may answer my next question which is:
   if mls “qos cos overide 0” will overwrite the current markings for marked and unmarked frames.
   What is the difference between that and “Switch priority extend cos 0”
   Because this later also writes 0 to cos value.

3. question on Cos-to-DSCP or DSCP-to-Cos map. is there a way to know what these maps would be? say I want my dscp to be 46 and its changing the dscp based on a cos value in a map how can I know or control this so its not a loose cannon?

I think those little nuisances are all the questions I have right now. helps me remember if I can more fully understand how the commands fit in and their relationship to that areas of study.

Thanks ahead of time. I appreciate all the help on my other questions in different post. I may not always reply to keep the forums uncluttered but to me sharing information and teaching is special and you guys are my heroes!

[lagapidis (Lazarus Agapidis)]

Hello Brian.

I will attempt to answer your questions below:

Question 1

@wilder7bc

is Switch port priority exclusive to cisco phone? I am use to switchport being a interface command so seems odd this command would only have to deal with cisco ip phone and not just the interface in general but that’s kind of what I got from your explanation.

According to Cisco:

switchport priority extend
Use the switchport priority extend interface configuration command to set a port priority for the incoming untagged frames or the priority of frames received by the IP phone connected to the specified port.

This command is most often used for IP phones but can theoretically be used by any CDP enabled device. The command specifically tells the device connected to this port (IP phone or otherwise) what to do with frames tagged with a non-default priority. The specific keyword “trust” specifies that the switch will send CDP packets to the device informing it to trust tagged data traffic.

99% of the time, the device that will be on the receiving end of these CDP packets will be an IP phone.

Question 2

@wilder7bc

depending on how you answer 1 this may answer my next question which is:
if mls “qos cos overide 0” will overwrite the current markings for marked and unmarked frames.
What is the difference between that and “Switch priority extend cos 0”
Because this later also writes 0 to cos value.

According to Cisco, the command you mention should be implemented in two parts:

mls qos cos 0  ! resets the default to 0 (the default is 0 unless changed)
mls qos cos overide  !this overrides any other value given to packets that enter the port to the default configured above

So this command is applied to the port of the switch.

Conversely, the command switch priority extend cos 0 sets the IP phone access port to override the priority received from the PC or the attached device. This is applied to the access port of the IP phone.

Question 3

@wilder7bc

question on Cos-to-DSCP or DSCP-to-Cos map. is there a way to know what these maps would be? say I want my dscp to be 46 and its changing the dscp based on a cos value in a map how can I know or control this so its not a loose cannon?

Again, Cisco states the following:

All of the CoS-to-DSCP and DSCP-to-CoS maps are globally defined. You apply all maps to all ports.
If you enter the mls qos trust cos command, the default CoS-to-DSCP map is applied.
If you enter the mls qos trust dscp command, the default DSCP-to-CoS map is applied.
After a default map is applied, you can define the CoS-to-DSCP or DSCP-to-CoS map by entering consecutive mls qos map commands.
If the mls qos trust dscp command is entered and a packet with an untrusted DSCP value is at an ingress port, the packet CoS value is set to 0.

Finally, you can use the show mls qos maps command to determine the current mappings.

I hope this has been helpful!

Laz

[samson.woubayehu (Samson W)]

Hi Rene,

Thank you for this good article. We have 2960 s and x access switches and Cisco phone. Most of the PCs are connected to the Cisco Phone. We also usein Cisco Jabber as softphone. If we want to trust & mark both Jabber & phone traffic (ingress & egress) how do we configure the access and the uplink ports? With our current config see below we see only outgoing traffic is marked but not the incoming. Outgoing shows EF and incoming CS0.

interface GigabitEthernet1/0/1
switchport access vlan 4
 switchport mode access
 switchport voice vlan 2
 srr-queue bandwidth share 10 10 60 20
 srr-queue bandwidth shape 10 0 0 0
 queue-set 2
 priority-queue out
 no snmp trap link-status
 mls qos trust device cisco-phone
 mls qos trust cos
 auto qos voip cisco-phone
 storm-control broadcast level 20.00
 storm-control action trap
 spanning-tree portfast
 service-policy input AutoQoS-Police-CiscoPhone

interface GigabitEthernet1/0/50
 switchport mode trunk
 switchport nonegotiate
 srr-queue bandwidth share 1 30 35 5
 srr-queue bandwidth shape 10 0 0 0
 queue-set 2
 priority-queue out
 udld port
 mls qos trust cos
 auto qos trust
 spanning-tree guard loop

We tried also the below. But didn’t helped.

interface GigabitEthernet1/0/1
 switchport access vlan 4
 switchport mode access
 switchport voice vlan 2
 srr-queue bandwidth share 1 30 35 5
 srr-queue bandwidth shape 10 0 0 0
 queue-set 2
 priority-queue out
 no snmp trap link-status
 mls qos trust dscp
 auto qos trust
 storm-control broadcast level 20.00
 storm-control action trap
 spanning-tree portfast

interface GigabitEthernet1/0/50
 switchport trunk 
 switchport mode trunk
 srr-queue bandwidth share 1 30 35 5
 srr-queue bandwidth shape 10 0 0 0
 queue-set 2
 priority-queue out
 udld port
 mls qos trust dscp
 auto qos trust
 storm-control broadcast level 20.00
 storm-control action trap
 spanning-tree guard loop

Thank you
Samson

[relja.s]

“By default your switch will overwrite the DSCP value of the packet inside your frame according to the cos-to-dscp map.”

Can a Layer2 (cisco 2960) switch overwrite DSCP value ? Or this works only on L3 switches?

[ReneMolenaar]

Hi Relja,

Yes, they can, that is no problem. L2 switches like the 2960 do support some L3 features like setting the DSCP bits. Their limitation with L3 is usually about routing.

Rene

[florianl (florian k)]

Hi Rene,

you mention:
“Just type mls qos cos to set a CoS value yourself. In the example above I will set a CoS value of 4 to all untagged frames. Any frame that is already tagged will not be remarked with this command.”

1. How does the switch know that only the CoS of untagged frames shall be changed?
2. I thought only tagged frames have a CoS field?

Thanks
Florian

[lagapidis (Lazarus Agapidis)]

Hello Florian

When the mls qos cos command is used on the interface, any untagged incoming frames will be dealt with by the switch using the configured default cos value. In other words, this default CoS value is used as the criteria to select one output queue as an index into the CoS-to-DSCP map for untagged frames. The CoS value doesn’t actually have to be stored in the frame itself (and it is not as you very correctly stated that untagged frames don’t have a CoS field).

Now any frames that are already tagged will by default use the CoS value that is stored in the tag and will not use the default value configured with the mls qos cos command. If however you use the command mls qos cos cos-value override, then the configured CoS value of this command will override any CoS value found in the tag of the frame.

You can find more info at this Cisco command reference link:
https://www.cisco.com/c/en/us/td/docs/ios/qos/command/reference/qos_book/qos_m2.html#wp1041343

I hope this has been helpful!!

Laz

[florianl (florian k)]

Got it!

Thanks for your help again Laz!

[eyal1994zloof (eyal z)]

Hii,
The images are missing in this article.
Thanks

[mikesolavi (Michael S)]

Hi Rene,
Great lesson of QoS, thanks for your easy explanations. In this document it seems the images are not loading, I tried from different PCs to make sure it was not my PC experiencing the problem, it seems to be at the website end, or let me know if there is anything I must change on my browser(tried with Chrome and Firefox)…

Best regards,

[lagapidis (Lazarus Agapidis)]

Hello and thanks to both @mikesolavi and @eyal1994zloof for pointing this out.

I’ll let Rene know and take a look as soon as possible.

Thanks again!

Laz

[ReneMolenaar]

Hi Michael,

Sorry for the inconvenience. We just fixed the images. Thanks for letting us know!

Rene

[mikesolavi (Michael S)]

Hi Rene,

Thanks for fixing it! Have a nice week.

[gaby.ochoa (martha o)]

Hello guys,
I followed the configurations from this lesson and after doing

#mls qos cos override

I was not able to get the COS override enabled.
please look below:

I made sure qos was enabled on the switch here:

This is the image I am running on this switch:

Thanks in advance
-gaby8a

[lagapidis (Lazarus Agapidis)]

Hello Martha

Hmm, that’s strange. Your configurations seem correct. Are you using GNS3? Sometimes GNS3 may have some such behaviour. If so I suggest you attempt changing the IOS version you are using and see if that makes a difference. As far as configs go, it looks correct.

I wish I could have been more helpful!

Laz