QoS on LAN switches: trust boundaries, CoS-DSCP mapping and egress queues

Why a fast LAN still needs QoS

It is tempting to say a 1 or 10 Gbps campus never needs QoS. Two things prove otherwise. First, speed mismatches: traffic arriving on a 10 Gbps uplink and leaving on a 1 Gbps access port must queue. Second, microbursts: many senders transmitting at the same moment can fill a port buffer for a few milliseconds, even when the five-minute average is low. Switch buffers are small, so drops happen quickly. Voice and video suffer first.

The trust boundary

A switch port can be in one of three states for incoming marks:

• Untrusted: marks are rewritten to 0 (or to a value set by policy). Use this for user PCs, guest devices and printers, otherwise anyone could mark their downloads as EF.
• Trust DSCP or trust CoS: marks are kept. Use this on uplinks between switches you manage and on ports to servers or appliances you control.
• Conditional trust: trust only if a known device is detected. On Cisco switches, the switch uses CDP to recognise a Cisco IP phone and trusts its marks; if a PC is plugged in instead, the port stays untrusted.

IP phones usually have a PC port. The phone marks its own voice as EF with CoS 5 and re-marks traffic from the attached PC to 0, which extends the trust boundary to the phone.

Mapping CoS and DSCP

An access switch may receive CoS on a voice VLAN trunk-style port and DSCP inside the IP packet. Switches hold internal maps to translate one into the other. The default CoS-to-DSCP map gives CoS 5 a DSCP of 40 (CS5), not 46, so on older Catalyst switches engineers changed it so that CoS 5 becomes EF. When a frame leaves on a trunk, the switch can also derive the CoS value from the DSCP.

Egress queues

Each switch port has a small number of hardware queues, often four or eight, with one able to act as a strict priority queue. Marks decide which queue a frame enters and which drop threshold applies.

Legacy Catalyst MLS QoS (for example 2960, 3560 and 3750)

These platforms used mls qos commands. QoS was off by default, and when you enabled it every port became untrusted until configured. Each port had four egress queues serviced by shaped or shared round robin (SRR), and priority-queue out made queue 1 a priority queue.

mls qos
mls qos map cos-dscp 0 8 16 24 32 46 48 56
interface GigabitEthernet1/0/5
 description Phone and PC
 switchport voice vlan 110
 mls qos trust device cisco-phone
 mls qos trust cos
 priority-queue out
interface GigabitEthernet1/0/48
 description Uplink to distribution
 mls qos trust dscp

Modern Catalyst 9000 (IOS XE)

Catalyst 9000 switches use the same MQC syntax as routers, and they trust incoming DSCP and CoS by default. You therefore apply an input policy to re-mark untrusted ports, and an output policy with a priority level 1 class for voice. The auto qos voip cisco-phone interface command generates a validated set of class maps, policies and queues, which is a sensible starting point that you can then review.

policy-map UNTRUSTED-IN
 class class-default
  set dscp default
interface GigabitEthernet1/0/20
 description Guest kiosk
 service-policy input UNTRUSTED-IN

Real-world example: a school staffroom

A secondary school installed IP phones in classrooms, each with a teacher's laptop plugged into the phone. Calls to the office were clear, until a teacher's laptop started a large cloud sync and the staff complained of broken audio on that floor. The engineer found that the access ports trusted DSCP from any device, and the sync software was marking its traffic as EF, so it shared the priority queue with voice. He changed the access ports to conditional trust, so only CDP-detected phones were trusted, and the laptop traffic was reset to default. The calls recovered immediately.