Campus · Access-port QoS
Generate Cisco Catalyst 9000 access-port QoS config that trusts markings only from real IP phones / softphones and re-marks everything else. Stops DSCP spoofing at the edge.
On a Cisco campus, QoS trust starts — and very often ends — at the access port. If a user plugs in a laptop that decides to mark all its packets EF, your WAN LLQ will starve. The fix is a trust boundary: trust DSCP only from devices you believe (via CDP or LLDP-MED), otherwise classify-and-mark on ingress.
The generated policy assigns every access port a conditional trust: trust DSCP/CoS if and only if the phone is discovered via CDP (or LLDP-MED). If no phone is detected, ingress packets are classified by ACL and marked. Softphone traffic from the PC is by default re-classified — because Windows QoS markings are easy to spoof.
If your environment uses Cisco 88xx phones, Webex App with a well-managed Intune/GPO policy, and a locked-down PC image, trusting DSCP on the access port is safe. If your environment has a mix of BYOD, legacy devices, or users with admin rights, re-mark on ingress using an ACL that matches known signaling/media flows.
Uplinks from access to distribution are trunks. They inherit the edge markings but you should still apply an output queuing policy (1P7Q3T or 2P6Q3T depending on platform) so that voice/video get priority in the switch hardware buffers during bursts.
AutoQoS is a solid starting point. It builds class-maps, policy-maps, and interface commands. The downside is rigidity — if your environment deviates (different voice vendor, unusual apps), you're left fighting AutoQoS's defaults. Use it as a template, then customize.
Yes — from IOS-XE 16.8+. Configure trust device lldp or trust device both. Make sure the phone's LLDP-MED network-policy TLV matches your voice VLAN.
CDP/LLDP-MED times out after ~180s, the conditional trust falls back to untrusted, and ingress re-marking kicks in. The laptop's DSCP is rewritten.
24 ports, Cisco 8841 phones with PCs daisy-chained, CDP trust, voice VLAN 210, data VLAN 10. Softphone on PC re-classified.
LLDP-MED required. Conditional trust with trust device lldp. Phone network-policy TLV set to tag voice VLAN 215 with DSCP 46.
Room system (Cisco Board Pro) on ports 1-4, rest open-collaboration. Trust CDP on 1-4, re-classify on 5-48.