We currently are deploying 1 broad application policy to our sites. I noticed the QoS statements however showed a few peculiar things:
1. The ACL entries for voice-in are statically configured to specific phone IPs:
20 permit ip host 10.123.456.78 any dscp ef
30 permit ip host 10.123.456.79 any dscp ef
40 permit ip host 10.123.456.80 any dscp ef
...
Upon inspecting further, new phones were plugged in and of course their IPs were not on the ACL. Surely this is not the default official CVD recommended? My approach I guess is to recommend marking our whole voice subnet in the ACL.
2. The same policy is being applied to trunks. So marking is happening at the uplink. This seems very odd, but maybe there is some new DNAC best practice I'm unaware of? I'd figure the paradigm of marking at the access ports was still the typical way and trunks get trust statements.
Any advice would be appreciated. Thanks!
