3850 switches: How to disable qos trust dscp on wired interfaces?

[Nadav]

Hi everyone,

I'm migrating from 3750 to 3850 switches. It seems that contrary to 3750s, 3850s trust DSCP markings on ingress traffic by default.

I'm interested in removing this trust (something akin to "no mls qos trust dscp").  

I'd prefer a way to disable trust by default, and only apply it where necessary. If I can't configure it by default, then a per-interface solution would be the next best thing.

Does anyone know how to accomplish this?

[Rolf Fischer · Accepted solution]

Hi,

I believe the only way to accomplish the behavior of an untrusted port on IOS-XE platforms is to apply an ingress service-policy with class-default (only) and a 'set dscp 0'.

policy-map UNTRUST
 class class-default
  set dscp 0
!
interface x/y
 service-policy input UNTRUST

Other thoughts or a confimation from other forum members would be appreciated!

HTH
Rolf

[Nadav]

That's what appeared in the documentation as well, it'll have to do. Thanks :)

[paul driver]

hello

Switch interface specific ?

int x/x

mls qos cos x (tagged)

switchport priority extend cos x (untagged)

mls qos cos x override ( tagged - un tagged)

however I have may mis interpreted the OP

res

paul

[Rolf Fischer]

Hello Paul,

thanks for joining!

Unlike the cat3750, the cat3650/3850 platforms run IOS-XE and no longer support the old 2k/3k mls qos commands but MQC now. QoS now is enabled by default and the interfaces are trusted by default. Important changes when migrating from old to new.

Regards,

Rolf

[paul driver]

Hello Rolf 

I didn't know that cheers for the heads up

i guess a review of it white paper is in order!

The beauty of these forums never cease to amaze me !

res

paul

[Joseph W. Doherty]

Newer switches work like routers have, i.e. by default, they don't change/reset ToS.  So, as Rolf shows, you would need to configure a policy to change/reset ToS, as desired.

Also BTW, 3750s only "untrusted" when QoS was globally enabled.  If QoS wasn't enabled, they too would pass/accept ToS as found.