Service-policy input/output question

[Dean Romanelli]

Hi All,

When configuring a class-map on a switch or WAP to assign a DSCP value to a packet being received from a host that has no native or configured marking set, I would do service-policy input on the switchport connected to the host on the switch, and input on the dot11radio interface correct?

I read a tutorial on how to configure this and the writer applied his service-policy for QOS marking in the output direction on his dot11radio interface, which didn't make sense to me, so just want to confirm.  Thanks.

[Joseph W. Doherty · Accepted solution]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages wha2tsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Yes, you can mark on ingress as you describe, but marking on egress might be possible too (as might have been shown in the example you mention reading).  For example, a wireless host's packet would be egress on the AP's Ethernet port.  Or, for an wired example, a host's ingress might be marked on the switch's uplink port's egress.

Service policies are applied much like ACLs, either ingress or egress (NB: many switches don't support egress policies, most routers, though, do).

[Dean Romanelli]

Helpful as always, thanks Joseph.

One follow up:  If I apply the service policy to the ingress of the radio port only, will the marking I set in the map be preserved over to the switchport on the receiving switch as long as that switchport is set to trust the dscp, or do I need to put the service-policy onto the ethernet port of the WAP in output direction to ensure that?  Would it make sense to configure the service policy as ingress on radio AND egress on ethernet? Or would it just need to be 1 or the other and not both?

[Joseph W. Doherty]

As long as the switch trusts the AP's port, you shouldn't need another policy there.

You normally only need to analyze and mark once.  Ingress policies are often used to verify/mark.  Egress policies (if supported by the device) used for treating traffic.

[Dean Romanelli]

Ok so on the AP if I mark at the ingress of the radio interface only and not at all on the egress ethernet, that marking will still be carried across the ethernet port to the switch and will be preserved as long as the receiving switch is trusting the DSCP values right? No need to configure anything further on the ethernoet port on the WAP-side?

[Joseph W. Doherty]

Correct, but remember, on many switches if QoS is enabled, you need to manually at least configure trust, otherwise the DSCP setting will be reset to zero.

[Dean Romanelli]

By manually configuring trust, you mean just configuring mls qos trust dscp on the switchport connecting to the access point, and the switchport connecting to the next switch right? No other trust commands needed?

[Joseph W. Doherty]

Yes