Enterprise QoS Solution Reference Network Design Guide

Chapter 2 Campus QoS Design
Trusted Endpoints
Version 3.3
Enterprise QoS Solution Reference Network Design Guide
QoS Design Overview
Trusted endpoints have the capabilities and intelligence to mark application traffic to the appropriate
CoS and/or DSCP values. Trusted endpoints also have the ability to remark traffic that may have been
previously marked by an untrusted device. Trusted endpoints are not typically mobile devices, which
means that the switch port into which they are plugged does not usually change.
Note Cisco IP Phones, which often change switch ports as users move, are more appropriately classified as
conditionally-trusted endpoints.
Examples of trusted endpoints include the following:
Analog gateways—These devices connect analog devices such as fax machines, modems,
TDD/TTYs, and analog phones to the VoIP network, such that the analog signals can be packetized
and transmitted over the IP network.
Examples of analog gateways include the following:
– Analog network modules (NM-1V and NM2-V, which support either high- or low-density
Voice/Fax Interface Cards (VICs)
– Cisco Communication Media Module (CMM) linecard
– Catalyst 6500 Analog Interface Module (WS-X6624-FXS).
– Cisco VG224 and VG248 IOS-based voice gateways
IP conferencing stations—These devices are specialized IP Phones with 360 degree microphones
and advanced speakerphones designed for meeting room VoIP conferencing. Examples of such
devices include the Cisco 7935 and 7936.
Videoconferencing gateways and systems—These devices transmit interactive video across the IP
network. Examples of such devices capable of setting DSCP markings include the Cisco IP/VC
3511, 3521, 3526 and 3540 videoconferencing gateways and systems. If, on the other hand,
video-conferencing devices do not have the ability to set DSCP markings correctly, they should be
treated as untrusted devices.
Video surveillance units—These third-party devices are used for security and remote monitoring
purposes over an IP (as opposed to a closed-circuit) network. These may support DSCP marking, in
which case they may be considered trusted endpoints.
Servers—Certain servers, within the data center or otherwise, might be capable of correctly marking
their traffic on their NICs. In such cases, the network administrator can choose to trust such
markings. However, enforcing such a trust boundary requires cooperation between network
administrators and system or server administrators, an alliance that is often fragile, at best, and
usually involves considerable finger pointing. Additionally, network administrators should bear in
mind that the majority of DoS/ worm attacks target servers. Infected servers not only might spew
profuse amounts of traffic onto the network, but, in such cases, they might do so with trusted
markings. There’s no hard-and-fast rule that will apply to every situation. Some administrators
prefer to trust certain servers, like Cisco CallManagers, due to the large number of ports that may
be in use to provide services rather than administer complex access lists. In either case, consider the
tradeoffs involved when deciding whether or not to trust a server.
Wireless access points—Some wireless access points (APs) have the ability to mark or remark
802.1p CoS and/or DSCP values and therefore qualify as trusted endpoints. Examples include Cisco
Aironet 350, 1100 and 1200 series APs.
2-7