Enterprise QoS Solution Reference Network Design Guide
Enterprise QoS Solution Reference Network Design Guide
Enterprise QoS Solution Reference Network Design Guide
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>QoS</strong> <strong>Design</strong> Overview<br />
2-10<br />
<strong>Enterprise</strong> <strong>QoS</strong> <strong>Solution</strong> <strong>Reference</strong> <strong>Network</strong> <strong>Design</strong> <strong>Guide</strong><br />
Chapter 2 Campus <strong>QoS</strong> <strong>Design</strong><br />
Figure 2-5 Untrusted Endpoint Policing—Multi-Application Server + Scavenger Model<br />
Start<br />
Mission-Critical<br />
Data ACLs<br />
Transactional<br />
Data ACLs<br />
Bulk<br />
Data ACLs<br />
Remember that when deploying <strong>QoS</strong> designs for untrusted servers, the applications are usually identified<br />
by source ports, and not destination ports (as is the case with client-to-server access lists). Thus the<br />
access list becomes:<br />
permit [tcp | udp] any [eq | range] any<br />
as opposed to:<br />
Conditionally-Trusted Endpoints<br />
permit [tcp | udp] any any [eq | range]<br />
This is a subtle but critical difference.<br />
This section includes the following topics:<br />
Cisco IP Phones<br />
MCD ACLs<br />
Cisco Auto<strong>QoS</strong>—VoIP<br />
No<br />
TD ACLs<br />
No<br />
Bulk Data<br />
ACLs<br />
No<br />
Yes<br />
Yes<br />
Yes<br />
15 Mbps<br />
35 Mbps<br />
Conditionally-Trusted IP Phone + PC with Scavenger-Class <strong>QoS</strong> (Basic) Model<br />
Conditionally-Trusted IP Phone + PC with Scavenger-Class <strong>QoS</strong> (Advanced) Model<br />
One of the main business advantages of IP telephony is the simplicity and related cost savings of user<br />
adds/moves/changes. To move, a user simply picks up their IP phone, plugs it in at his or her new<br />
location and carries on business as usual. If their infrastructure supports inline power, it is literally a<br />
matter of unplugging a single RJ-45 cable and plugging it in at the new location.<br />
IP phones are trusted devices, while PCs are not. This can be a problem when provisioning trust in a<br />
mobile environment. Consider the following example: Port A is configured to trust the endpoint<br />
connected to it, which initially is an IP phone. Port B is configured not to trust the endpoint connected<br />
to it, which initially is a PC. Because of a move, these endpoints get plugged into the opposite ports. This<br />
breaks the VoIP quality of calls made from the IP phone (now plugged into untrusted Port B) and opens<br />
the network up for unintentional or deliberate abuse of provisioned <strong>QoS</strong> by the PC (now plugged into<br />
the trusted Port A).<br />
No<br />
No<br />
No<br />
No<br />
Yes Re-Mark to DSCP 25<br />
and Transmit<br />
Yes<br />
Yes<br />
Yes<br />
Re-Mark to DSCP CS1<br />
and Transmit<br />
Re-Mark to DSCP AF21<br />
and Transmit<br />
Re-Mark to DSCP CS1<br />
and Transmit<br />
Re-Mark to DSCP AF11<br />
and Transmit<br />
Re-Mark to DSCP CS1<br />
and Transmit<br />
Re-Mark to DSCP 0<br />
and Transmit<br />
Re-Mark to DSCP CS1<br />
and Transmit<br />
Version 3.3
Change language