Enterprise QoS Solution Reference Network Design Guide

QoS Design Overview
Untrusted Endpoints
2-8
Enterprise QoS Solution Reference Network Design Guide
Chapter 2 Campus QoS Design
Wireless IP Phones—Mobile wireless IP Phones can mark DSCP values for VoIP and call signaling
and pass these on to the wireless AP with which they are associated. Examples include the Cisco
7920G wireless IP Phone.
When trusted endpoints are connected to a switch port, all that is typically required is enabling the
following interface command: mls qos trust dscp.
Optionally, if the traffic rate of the trusted application is known, the network administrator could apply
an access layer policer to protect against out-of-profile rates, in case the trusted endpoint is somehow
compromised.
For example, consider the case of an IP videoconferencing (IP/VC) station that transmits 384 kbps of
video (not including Layer 2–4 overhead) and correctly marks this traffic to DSCP AF41. An access edge
ingress policer could be applied to the switch port to which this IP/VC station is connected and be
configured to trust up to 500 kbps, allowing for Layer 2–4 overhead and policer granularity of interactive
video traffic marked AF41. Excess traffic could be marked to CS1. Such a policy prevents network abuse
if another device is inserted, perhaps via a hub, into the path, or if the trusted endpoint itself becomes
compromised.
This section includes the following topics:
Untrusted PC + SoftPhone with Scavenger-Class QoS
Untrusted Server with Scavenger-Class QoS
As previously mentioned, trusting end users and their PCs is generally a bad idea because newer
operating systems like Windows XP and Linux make it relatively easy to set CoS or DSCP markings on
PC NICs. Such markings may be set deliberately or even inadvertently. In either case, improperly set
QoS markings can affect the service levels of multiple users within the enterprise and make
troubleshooting a nightmare. Also, marking application traffic on server NICs has disadvantages as
discussed in the previous section that may make it preferable to treat these as untrusted devices.
While client PCs and data center servers are related and complimentary, they also have unique
considerations that affect their classification and marking policies, and so will be examined individually.
Untrusted PC + SoftPhone with Scavenger-Class QoS
Cisco generally recommends not trusting end user PC traffic. However, some PCs may be running
applications that critically require QoS treatment. A classic example is a PC running Cisco IP Softphone.
In such a case, the critical application needs to be identified using access lists and marked/remarked at
the access edge. Remarking can be done with either an MLS QoS set ip dscp command or with a policer.
A policer is recommended in this case because limits on the amount of traffic being marked can then be
imposed to prevent abuse. Cisco SoftPhones can use regular G.711 codecs, in which case 128 kbps is
adequate, or they can be configured use a G.722 (wide codec), in which case 320 kbps is required. The
tighter the policer the better, provided that adequate bandwidth has been allocated for application
requirements.
Additionally, you can explicitly define the UDP ports used by Cisco SoftPhone within the application as
opposed to simply picking random ports within the UDP range of 16383–32767. This is recommended
because this allows for a more granular access list to match legitimate Cisco SoftPhone traffic, thereby
tightening the overall security of the policy.
Version 3.3