Cisco Systems 4500 Configuring a Trusted Boundary to Ensure Port Security

37-21
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 37 Configuring Quality of Service Configuring QoS on Supervisor Engines II-Plus, II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE
Note The qos rewrite ip dscp command is not supported on Supervisor Engine 6-E, Supervisor Engine 6L-E,
Catalyst 4900M, and Catalyst 4948E.
If you disable IP DSCP rewrite and enable QoS globally, the following events occur:
• The ToS byte on the IP packet is not modified.
• Marked and marked-down DSCP values are used for queueing.
• The internally derived DSCP (as per the trust configuration on the interface or VLAN policy) is used
for transmit queue and Layer 2 CoS determination. The DSCP is not rewritten on the IP packet
header.
If you disable QoS, the DSCP of the incoming packet are preserved and are not rewritten.
Configuring a Trusted Boundary to Ensure Port Security
In a typical network, you connect a Cisco IP phone to a switch port as discussed in Chapter 38,
“Configuring Voice Interfaces.” Traffic sent from the telephone to the switch is typically marked with a
tag that uses the 802.1Q header. The header contains the VLAN information and the class of service
(CoS) 3-bit field, which determines the priority of the packet. For most Cisco IP phone configurations,
the traffic sent from the telephone to the switch is trusted to ensure that voice traffic is properly
prioritized over other types of traffic in the network. By using the qos trust cos interface configuration
command, you can configure the switch port to which the telephone is connected to trust the CoS labels
of all traffic received on that port.
Note Starting with Cisco IOS Release 12.2(31)SG, Supervisor Engine V-10GE allows you to classify traffic
based on packet's IP DSCP value irrespective of the port trust state. Because of this, even when a Cisco
IP phone is not detected, data traffic can be classified based on IP DSCP values. Output queue selection
is not impacted by this new behavior. It is still based on the incoming port trust configuration. For
information on configuring transmit queues, refer to the “Configuring Transmit Queues” section on
page 37-50.
In some situations, you also might connect a PC or workstation to the Cisco IP phone. In this case, you
can use the switchport priority extend cos interface configuration command to configure the telephone
using the switch CLI to override the priority of the traffic received from the PC. With this command, you
can prevent a PC from taking advantage of a high-priority data queue.
However, if a user bypasses the telephone and connects the PC directly to the switch, the CoS labels
generated by the PC are trusted by the switch (because of the trusted CoS setting) and can allow misuse
of high-priority queues. The trusted boundary feature solves this problem by using the CDP to detect the
presence of a Cisco IP phone (such as the Cisco IP phone 7910, 7935, 7940, and 7960) on a switch port.
Note If CDP is not running on the switch globally or on the port in question, trusted boundary does not work.
When you configure trusted boundary on a port, trust is disabled. When a phone is plugged in and
detected, trust is enabled. (It may take a few minutes to detect the phone.) Now, when a phone is
unplugged (and not detected), the trusted boundary feature disables the trusted setting on the switch port
and prevents misuse of a high-priority queue.