Enterprise QoS Solution Reference Network Design Guide

Catalyst 2950—QoS Considerations and Design
2-20
Enterprise QoS Solution Reference Network Design Guide
Chapter 2 Campus QoS Design
A possible workaround to this limitation would be to pre-set the port(s) to be used by SoftPhone within
the application itself. In such a case, these ports would have to be discretely matched by ACL entries on
the Catalyst 2950. Furthermore, each port being used for call signaling would also require a discrete
ACL entry.
However, even in the case where all these ports are buttoned down and discrete ACLs are configured on
the Catalyst 2950 to match them, another limitation of the switch would come into play. Specifically, the
Catalyst 2950 can only support policing in 1 Mbps increments on FastEthernet ports. Such lax policing
would leave a fairly large hole to allow unauthorized traffic that may be mimicking Voice or call
signaling to be admitted onto the network.
Due to these limitations, it is not recommended to use a Catalyst 2950 to support an untrusted PC running
SoftPhone.
Catalyst 2950—Untrusted Server with Scavenger-Class QoS Model
Configuration
This section includes the following topics:
Configuration
Catalyst MLS QoS Verification Commands
For the most part, the Catalyst 2950 can support the Untrusted Multi-Application Server + Scavenger
Model as illustrated in Figure 2-5. Only the final element of the logical model, namely the policing of
all other traffic to 1 Mbps (remarking traffic in excess of this limit to CS1) is not supported on the
Catalyst 2950.
The main platform-specific caveats that should be kept in mind when deploying this model on the
Catalyst 2950 are the following:
Non-standard DSCP values are not supported; therefore, Mission-Critical Data traffic cannot be
marked to DSCP 25 on Catalyst 2950s (a temporary recommendation during the interim of Cisco’s
call signaling marking migration from AF31 to CS3); such application traffic can alternatively be
marked to the more general class of Transactional Data (AF21), of which they are a subset.
The mls qos cos override interface command must be used to ensure that untrusted CoS values are
explicitly set 0 (default).
The range keyword cannot be used in the ACLs being referenced by the class-maps; server-ports
should be explicitly defined with a separate access list entry (ACE) per TCP/UDP port.
User-defined masks must be consistent for all ACLs being referenced by class maps (if filtering is
being done against TCP/UDP ports, then all Access Control Entries (ACEs) should be set to filter
by TCP/UDP ports, as opposed to some ACEs filtering by ports and others by subnet or host
addresses).
System-defined masks (such as permit ip any any) cannot be used in conjunction with user-defined
masks (such as permit tcp any any eq 3200) within the same policy map; therefore, if some traffic
is being matched against TCP/UDP ports, then a final ACL cannot be used to match all other traffic
via a permit ip any any statement).
The Catalyst 2950 IOS implementation of MQC’s class-default does not (at the time of writing)
function compatibly with mainline IOS; class-default should apply a policy to all other traffic not
explicitly defined, but testing has shown that this is not the case.
Version 3.3