Cisco Systems C3850NM410G

Unlike wired, wireless is considered untrusted on the Cisco Catalyst 3850. The default trust setting for wireless

target is untrust: that is, the packets are marked down to 0 in the absence of SSID-based policy.

The startup configuration on the Cisco Catalyst 3850 always has the following CLI:

qos wireless-default-untrust

This CLI is part of the default configuration (automatically created) and cannot be modified in the current release.

That means the wireless will always be untrusted.

If trust behavior (similar to wired) is desired on wireless, table-maps need to be defined. The option of default copy

can be used to protect the markings in the table-maps.

Marking on the downstream traffic is not being preserved on wireless targets. Therefore, a table-map is required in

the downstream direction to retain the markings.

The following is a sample table-map that will retain the markings:

table-map dscp2dscp

default copy

Configuring Ingress Quality of Service

Ingress Classification

When creating QoS classification policies, the network administrator must consider applications that are to be

present at the access layer of the network (in the ingress direction). The applications present at the access edge

need to be classified to mark them with appropriate marking and/or policing.

MQC offers scalability and flexibility in configuring QoS and provides consistent configuration across various Cisco

switches and routers. The following sample configuration creates an extended access list for each application and

then applies it under class-map configuration mode:

ip access-list extended BULK-DATA

remark FTP

permit tcp any any eq ftp

permit tcp any any eq ftp-data

ip access-list extended DEFAULT

remark EXPLICIT CLASS-DEFAULT

permit ip any any

ip access-list extended MULTIMEDIA-CONFERENCING

remark RTP

permit udp any any range 16384 32767

ip access-list extended SCAVENGER

remark KAZAA

permit tcp any any eq 1214