Best Practice VLAN based QoS

[bradleyordner]

Hi,

I currently have two 65k's running VLAN based QoS. We are doing the dscp marking at the switches by ACL and then sending to the routers.

I also have two 4500 switches attached to the 6500 in Layer 2 mode only. The 4500's dont seem able to do vlan based Qos, so how can i extend the trust boundary to the 4500's?

Thanks

Brad

[Lei Tian]

Hi Brad,

4500 supports vlan-based qos. Did you see it is not working correctly?

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/54sg/configuration/guide/qos.html#wp1020988

Regards,

Lei Tian

[bradleyordner]

Hi,

Must be my IOS, that command is not available -

:cat4500e-ipbasek9-mz.122-44.SG1.bin

If I am able to use VLAN based QoS, is it best to apply the following on the Layer 2 switch -

Trust DSCP or Cos on the trunk links to the 65ks?

Apply access lists on the Layer 2 switch which to do the marking or just apply the policy and class maps -

class-map match-any GOLD-RT
  match access-group name GOLD-RT
class-map match-any SILVER-NRT2
  match access-group name SILVER-NRT2
class-map match-any SILVER-NRT3
  match access-group name SILVER-NRT3
class-map match-any SILVER-NRT1
  match access-group name SILVER-NRT1
class-map match-any GOLD-NRT
  match access-group name GOLD-NRT
!
!
policy-map QOS-MAP
  class GOLD-RT
   set ip dscp ef
  class GOLD-NRT
   set ip dscp af42
  class SILVER-NRT3
   set ip dscp af32
  class SILVER-NRT2
   set ip dscp af22
  class SILVER-NRT1
   set ip dscp af12
  class class-default
   set ip dscp default

Thanks for your help

[Lei Tian]

Hi,

Is that sup6E? sup6E's qos is little bit different, but you should be able to apply qos on physical port, or on a vlan. The difference is instead of applying service-policy under SVI, you need to attach the policy to vlan from vlan config mode.

sup6E does qos trust by default, no need to config trust on the uplink. On the 6500 side, since you are marking to dscp, it is easier to trust dscp.

Yes, you need to config the ACLs, class-map and policy-map on 4500.

HTHs,

Lei Tian

[bradleyordner]

Hi again,

Yes is a WS-X45-SUP6-E, although a can apply a service policy on a physical interface, i can only trust qos via this -

qos trust extend cos

or

qos trust device cisco-phone

Under the VLAN config mode there is no qos options......

#?
VLAN configuration commands:
  are           Maximum number of All Route Explorer hops for this VLAN (or
                zero if none specified)
  backupcrf     Backup CRF mode of the VLAN
  bridge        Bridging characteristics of the VLAN
  exit          Apply changes, bump revision number, and exit mode
  media         Media type of the VLAN
  mtu           VLAN Maximum Transmission Unit
  name          Ascii name of the VLAN
  no            Negate a command or set its defaults
  parent        ID number of the Parent VLAN of FDDI or Token Ring type VLANs
  private-vlan  Configure a private VLAN
  remote-span   Configure as Remote SPAN VLAN
  ring          Ring number of FDDI or Token Ring type VLANs
  said          IEEE 802.10 SAID
  shutdown      Shutdown VLAN switching
  state         Operational state of the VLAN
  ste           Maximum number of Spanning Tree Explorer hops for this VLAN (or
                zero if none specified)
  stp           Spanning tree characteristics of the VLAN
  tb-vlan1      ID number of the first translational VLAN for this VLAN (or
                zero if none)
  tb-vlan2      ID number of the second translational VLAN for this VLAN (or
                zero if none)

[Lei Tian · Accepted solution]

Hi,

4500 with sup-6e has qos enabled by default, and all ports are in trust by default. The 'qos' command is there when you want conditional trust a port with cisco phone attached on it. The vlan config mode I was referring is

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/44sg/command/reference/snmp_vtp.html#wp1256440

HTH,

Lei Tian

[bradleyordner]

Ah excellent, thanks for your help, I have applied ACL's with Policy map & class maps, looks like they are working.

Thanks again

[Lei Tian]

You are welcome!

Good luck!

Lei TIan

[bradleyordner]

Hi Lei,

I had one more question, more theory based. After applying the Service policy, Class Maps and the ACLS to mark the traffic, when do the command show access-lists is displays matches, which is good!

Although these switches are only running in Layer 2 mode, with a single SVI for management and dual port channels (trunks) to the core.

How does the switch match Layer 3 information from a Layer 2 frame? Does the supervisor do the DSCP to ToS/Cos mapping automatically being Qos is enabled by default?

Reason why i ask is I am still trying to get my head around QoS, and I like to know the theory about technolgies, makes troubleshooting easier :-)

Thanks again

Brad

[Lei Tian]

Hi Brad,

You had a good question. The qos setting does require ip routing, which is enable by default. So, even you only have 1 SVI on that switch, this switch is a L3 switch. The supervisor has  ACL/QOS ASIC to process the acl and qos setting in hardware. Yes, there is default dscp-cos map.

Regards,

Lei Tian