The Lazy Networker

1. Introduction

The QoS Trust Boundary defines where and how QoS markings (such as DSCP or CoS) are trusted, modified, or discarded in a network. It ensures that only trusted devices (like IP phones or network switches) can set QoS values, while preventing unauthorized or misconfigured endpoints from affecting network performance.

---

2. Why is the Trust Boundary Important?

If the network blindly trusts all QoS markings:
🚨 Security Risk – End users could set high-priority DSCP values to get more bandwidth.
🚨 Misconfiguration – Incorrect markings from endpoints can cause congestion.
🚨 Unfair Bandwidth Usage – A normal PC could mark its traffic as VoIP, starving real-time applications.

To prevent these issues, network devices must determine where to trust or overwrite QoS markings.

---

3. Where Should the Trust Boundary Be Set?

Trust Scenarios

Trust Model	Description	Example Devices
Trust at the Edge	QoS markings from endpoints are accepted	Cisco IP Phones
Trust at Access Switch	Switch verifies and applies QoS policies	Cisco Catalyst Switch
Trust at Distribution/Core	Only backbone switches/routers enforce QoS	Core Routers

Best Practices

✅ Endpoints (PCs, users) – 🚫 DO NOT TRUST (Override QoS values).
✅ IP Phones, APs – ✅ Trust QoS Markings (Mark and prioritize voice traffic).
✅ Access Switches – ⚠️ Conditional Trust (Verify markings, modify if needed).
✅ Core/Distribution Layer – ✅ Strictly Enforce QoS Policies.

---

4. Configuring the QoS Trust Boundary on Cisco Switches

Cisco switches allow administrators to set trust levels on interfaces:

A. Trust DSCP from an IP Phone, Not from a PC

Most Cisco IP Phones mark their own traffic correctly, but connected PCs should not be trusted.
To trust only the phone’s QoS markings:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport voice vlan 10
 mls qos trust dscp

• mls qos trust dscp → Trust DSCP values from IP phones.
• switchport voice vlan 10 → Ensures that phone traffic is correctly prioritized.

---

B. Remove Trust from an Untrusted Device (PC)

To override markings from PCs:

interface GigabitEthernet1/0/2
mls qos trust cos
mls qos trust device cisco-phone

• mls qos trust cos → Trust CoS (only if it’s coming from a phone).
• mls qos trust device cisco-phone → Trust markings only from a Cisco IP phone, not a PC.

---

C. Rewriting QoS Markings (Reclassify Traffic)

If untrusted devices send incorrect markings, we can override them:

policy-map RECLASSIFY
 class class-default
  set dscp default

interface GigabitEthernet1/0/3
 service-policy input RECLASSIFY

• This resets all traffic to DSCP 0 (Best Effort) unless explicitly classified.

---

5. Verifying Trust Settings

To check trust settings on an interface:

show mls qos interface GigabitEthernet1/0/1

To see traffic classification:

show policy-map interface GigabitEthernet1/0/1

---

6. Summary

Scenario	Configuration
Trust DSCP from IP Phone	mls qos trust dscp
Trust CoS from Cisco Phones Only	mls qos trust cos; mls qos trust device cisco-phone
Remove Trust from a PC	Apply policy to reset DSCP to default
Check Trust Settings	show mls qos interface

✅ Proper trust boundary configuration prevents abuse and ensures fair traffic prioritization! 🚀