Enterprise QoS Solution Reference Network Design Guide
Enterprise QoS Solution Reference Network Design Guide
Enterprise QoS Solution Reference Network Design Guide
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>QoS</strong> <strong>Design</strong> Overview<br />
2-14<br />
<strong>Enterprise</strong> <strong>QoS</strong> <strong>Solution</strong> <strong>Reference</strong> <strong>Network</strong> <strong>Design</strong> <strong>Guide</strong><br />
Chapter 2 Campus <strong>QoS</strong> <strong>Design</strong><br />
The standard (interface) configuration commands to enable Auto<strong>QoS</strong> are: auto qos voip. Depending on<br />
the platform, Auto<strong>QoS</strong> VoIP can support the following additional keyword commands:<br />
cisco-phone—When you enter the auto qos voip cisco-phone interface configuration command on<br />
a port at the edge of a network that is connected to a Cisco IP Phone, the switch enables the<br />
conditional-trusted boundary feature. The switch uses the Cisco Discovery Protocol (CDP) to detect<br />
the presence or absence of a Cisco IP Phone. When a Cisco IP Phone is detected, the ingress<br />
classification on the interface is set to trust the CoS marking of the received packet. When a Cisco<br />
IP Phone is absent, the ingress classification is set to not trust the CoS (or DSCP) value of any<br />
packet.<br />
cisco-softphone—When you enter the auto qos voip cisco-softphone interface configuration<br />
command on a port at the edge of the network that is connected to a device running the Cisco<br />
SoftPhone, the switch uses policing to decide whether a packet is in or out of profile and to specify<br />
the action on the packet. If the packet does not have a DSCP value of 24, 26, or 46 or is out of profile,<br />
the switch changes the DSCP value to 0.<br />
trust —When you enter the auto qos voip trust interface configuration command on a port<br />
connected to the interior of the network, the switch trusts the CoS value in ingress packets (the<br />
assumption is that traffic has already been classified by other edge devices).<br />
The Auto<strong>QoS</strong> commands and optional keywords are shown on a per-platform basis in the<br />
platform-specific design sections of this chapter.<br />
Additionally, it should be pointed out that Auto<strong>QoS</strong> VoIP can also be viewed as a template which may<br />
be modified and expanded on to support additional classes of applications. In this manner, the Auto<strong>QoS</strong><br />
VoIP feature can be used to quickly and accurately deploy 80% (or more) of the desired solution, which<br />
then can be manually customized further to tailor to the specific customer requirements.<br />
Conditionally-Trusted IP Phone + PC with Scavenger-Class <strong>QoS</strong> (Basic) Model<br />
In this model, trust of CoS markings is extended to CDP-verified IP Phones. An additional layer of<br />
protection can be offered by access edge policers. As stated previously, the tighter the policers the better,<br />
provided that adequate bandwidth is permitted for legitimate applications. The most granular policing<br />
can be achieved by the use of per-port/per-VLAN policers.<br />
Note Currently, only the Catalyst 3550 family supports per-port/per-VLAN policing as a feature. Other<br />
platforms have already committed to supporting this feature in the near future. For platforms that do not<br />
yet support this feature, equivalent logic can be achieved by including subnet information within the<br />
access lists being referenced by the class maps. Such examples are provided later in this chapter.<br />
For example, the peak amounts of legitimate traffic originating from the voice VLAN (VVLAN) on a<br />
per-port basis are:<br />
128 kbps for Voice traffic, marked CoS 5/DSCP EF (320 kbps in the case of G.722 codecs)<br />
32 kbps for call signaling traffic (marked CoS 3/DSCP AF31 or CS3)<br />
32 kbps of Best Effort services traffic (marked CoS 0)<br />
There should not be any other traffic originating from the VVLAN, so the policer can be configured to<br />
remark anything else from the VVLAN because such traffic is considered illegitimate and indicative of<br />
an attack.<br />
These policers can then be combined with a policer to meter traffic from the data VLAN (DVLAN),<br />
marking down traffic in excess of 5 percent (5 Mbps for FE ports) to Scavenger/CS1.<br />
Version 3.3