Cisco 2950 Software Configuration Guide - Page 584

Configuring Standard QoS Chapter 30 Configuring QoS With the trusted setting, you also can use the trusted boundary feature to prevent misuse of a high-priority queue if a user bypasses the telephone and connects the PC directly to the switch. Without trusted boundary, the CoS labels generated by the PC are trusted by the switch (because of the trusted CoS setting). By contrast, trusted boundary uses CDP to detect the presence of a Cisco IP Phone (such as the Cisco IP Phone 7910, 7935, 7940, and 7960) on a switch port. If the telephone is not detected, the trusted boundary feature disables the trusted setting on the switch port and prevents misuse of a high-priority queue. Note that the trusted boundary feature is not effective if the PC and Cisco IP Phone are connected to a hub that is connected to the switch. In some situations, you can prevent a PC connected to the Cisco IP Phone from taking advantage of a high-priority data queue. You can use the switchport priority extend cos interface configuration command to configure the telephone through the switch CLI to override the priority of the traffic received from the PC. Beginning in privileged EXEC mode, follow these steps to configure trusted boundary on a switch port: Step 1 Step 2 Step 3 Command configure terminal cdp enable interface interface-id Step 4 cdp enable Step 5 mls qos trust device cisco-phone Step 6 mls qos trust cos Step 7 Step 8 Step 9 end show mls qos interface [interface-id] [policers] copy running-config startup-config Purpose Enter global configuration mode. Enable CDP globally. By default, it is enabled. Specify the interface to be trusted, and enter interface configuration mode. Valid interfaces include physical interfaces. Enable CDP on the interface. By default, CDP is enabled. Configure the Cisco IP Phone as a trusted device on the interface. You cannot enable both trusted boundary and auto-QoS (auto qos voip interface configuration command) at the same time; they are mutually exclusive. Configure the port trust state to trust the CoS value of the ingress packet. By default, the port is not trusted. Note In software releases earlier than Cisco IOS Release 12.1(11)EA1, the mls qos trust cos command is available only when the switch is running the EI. For more information on this command, refer to the command reference for this release. Return to privileged EXEC mode. Verify your entries. (Optional) Save your entries in the configuration file. When you enter the no mls qos trust interface configuration command, trusted boundary is not disabled. If this command is entered and the port is connected to a Cisco IP Phone, the port does not trust the classification of traffic that it receives. To disable trusted boundary, use the no mls qos trust device interface configuration command If you enter the mls qos cos override interface configuration command, the port does not trust the classification of the traffic that it receives, even when it is connected to a Cisco IP Phone. 30-24 Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide 78-11380-10