4

We have an incoming QoS configuration on our 2960X switches like this:

class-map match-any QOS_GL_TRUST
 match ip dscp 8 16 24 32 46 
class-map match-any QOS_GL_CITRIX
 match access-group name QOS_GL_CITRIX

policy-map QOS_LAN_IN
 class QOS_GL_TRUST
  trust dscp
 class QOS_GL_CITRIX
  set dscp 32
 class class-default
  set dscp default

So basically, this accepts the packets and keeps the markings for DSCP8,16,24,32, and 46. If not already marked by DSCP32, Citrix traffic will match the ACL and a marking of DSCP32 will be set. All other DSCP markings are overwritten with DSCP0. So this works great so far. Now we want to have the same configuration on our Cisco 3850 switches. But we dont have the trust command:

switch(config-pmap-c)#? 
Policy-map class configuration commands:
  bandwidth        Bandwidth
  drop             Drop all packets
  encap-sequence   MCMLP encapsulate sequence
  exit             Exit from class action configuration mode
  netflow-sampler  NetFlow action
  no               Negate or set default values of a command
  police           Police
  priority         Strict Scheduling Priority for this Class
  queue-buffers    queue buffer
  queue-limit      Queue Max Threshold for Tail Drop
  service-policy   Configure QoS Service Policy
  set              Set QoS values
  shape            Traffic Shaping

So if i want to achieve the same job as on the 2960X Switches, i'd have to do following:

class-map match-any QOS_GL_VOICERTP
 match ip dscp 46
class-map match-any QOS_GL_CITRIX
 match ip dscp 32
 match access-group name QOS_GL_CITRIX
class-map match-any QOS_GL_VOICESIP
 match ip dscp 24
class-map match-any QOS_GL_MANAGEMENT
 match ip dscp 16
class-map match-any QOS_GL_TRASH
 match ip dscp 8

policy-map QOS_LAN_IN
class QOS_GL_VOICERTP
  set dscp 46
 class QOS_GL_CITRIX
  set dscp 32
 class QOS_GL_VOICESIP
  set dscp 24
 class QOS_GL_MANAGEMENT
  set dscp 16
 class QOS_GL_TRASH
  set dscp 8
 class class-default
  set dscp default

So you can see that the 3850er configuration is much more code. So is there a better solution to achieve this? I am talking about the marking only, no actual QoS prioritization going on here.

3

The newer Cisco switches (3K, 4K, 9K) trust by default, so the trust command is no longer there. The QoS is implemented differently on those switches. You need somewhat different QoS configurations for different switch families.

Another difference that you may notice is that you can only do port-based QoS on the 2K switches, but you can do VLAN-based QoS on the 3K, 4K, and 9K switches. Also, you have limited TCAM space on the 2K switches, and you may need to adjust the TCAM allocation if you start to run out (see the answer to this question).

  • ... and on the 3650 series, too. The MQC configuration style for QoS is now much more in line with the router's configuration style. – Marc 'netztier' Luethi May 8 '19 at 13:56
  • Thanks for the warning about the TCAM. I didnt know about it. Will observe now with the show platform tcam utilization command. About the default trusting behaviour of the 3K platform, am I right to assume that i can use a similar configuration as on the 2960X with just nothing under the class class QOS_GL_TRUST and it will trust the DSCP markings of 8 16 24 32 and 46? – Mario Jost May 9 '19 at 16:16
  • @MarioJost, routers and the newer switch families will simply trust any DSCP value that comes into them. The older switches and the 2Ks will rewrite the DSCP to BE if QoS is enabled. That was apparently undesirable, but it still has not been remediated for even the newer 2K switches. The 2K switches have been a real pain for us when it comes to QoS because of the TCAM limitations, and we have moved on to the 9K switches for access switches. – Ron Maupin May 9 '19 at 21:08
1

Putting a "configurational" answer to my own question in case someone else stumbles upon the same question in the future... The following configuration on 2960X switches:

class-map match-any QOS_GL_TRUST
 match ip dscp 8 16 24 32 46 
class-map match-any QOS_GL_CITRIX
 match access-group name QOS_GL_CITRIX

policy-map QOS_LAN_IN
 class QOS_GL_TRUST
  trust dscp
 class QOS_GL_CITRIX
  set dscp 32
 class class-default
  set dscp default

Translates to 3850 models as follows:

class-map match-any QOS_GL_TRUST
 match ip dscp 8 16 24 32 46 
class-map match-any QOS_GL_CITRIX
 match access-group name QOS_GL_CITRIX

policy-map QOS_LAN_IN
 class QOS_GL_TRUST
 class QOS_GL_CITRIX
  set dscp 32
 class class-default
  set dscp default

So basically you can just skip the trust command because, as Ron Maupin pointed out, these switches trust DSCP by default. But it seemed very strange to me to have an empty class under a policy-map. I tested this scenario and it behaves as if you'd put trust DSCP under the class. So even if it looks wrong, this configuration works as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.