Applying Quality-of-Service (QOS) in Multi-Layer Switching (MLS) in a Cisco 3560MLS QOS has been one of the greatest fear for my CCIE RS exam. I’ve read it several times, labbed it more than 3 times, but still I just cannot understand it. Then I decided to write my own notes to teach myself and hopefully any of you mere mortals like me.

I’ll start with this Classification and Marking and let see how deep the rabbit hole goes for the next few parts.

Classification and MarkingLet’s just say that you have a switchport Fa0/1 configured for Vlan 100 and want to mark it as DSCP CS1 (Decimal 8).SW-3560(config)#mls qosSW-3560(config)#int f0/1SW-3560(config-if)#switchport access vlan 100SW-3560(config-if)#mls qos ? cos cos keyword dscp-mutation dscp-mutation keyword trust trust keyword vlan-based vlan-based keyword

We only left with COS option and no DSCP option available. COS field can only be found in 802.1q/ISL traffic which is the traffic on the trunk interface, and switchport access is not a trunk interface. In this case, we can use the COS option and then the switch will use the COS-DSCP mapping table to mark the packet as DSCP CS1 (Decimal 8). SW-3560# sh mls qos maps cos-dscp Cos-dscp map: cos: 0 1 2 3 4 5 6 7 -------------------------------- dscp: 0 8 16 24 32 40 48 56

We can actually change this mapping. For example, for most implementation we would like to set COS 5 = DSCP EF (Decimal 46). This is to keep the uniformity from end-to-end that DSCP EF (mostly for VOICE RTP) is mapped to COS 5.SW-3560(config)#mls qos map cos-dscp 0 8 16 24 32 46 48 56SW-3560(config)#mls qos map cos-dscp 0 8 16 24 32 46 48 56SW-3560(config)#do sh mls qos map cos-dscp Cos-dscp map: cos: 0 1 2 3 4 5 6 7 -------------------------------- dscp: 0 8 16 24 32 46 48 56

Based on the COS-DSCP map, to mark the packet to DSCP CS1 (Decimal 8), we can usemls qos cos 1.SW-3560(config)#mls qosSW-3560(config)#int f0/1SW-3560(config-if)#switchport access vlan 100SW-3560(config-if)#mls qos cos 1!SW-3560#sh mls qos int f0/1FastEthernet0/1trust state: not trustedtrust mode: not trustedtrust enabled flag: enaCOS override: disdefault COS: 1DSCP Mutation Map: Default DSCP Mutation MapTrust device: noneqos mode: port-based

We can combine the mls qos cos 1 with several commands below.

If the host is capable of marking the packets entering the switchport Fa0/1, we can also honour its value by trusting its DSCP or IP-PRECEDENCE or COS marking.

For IP packets, we can use mls qos trust dscp or mls qos trust ip-precedence. If the packets are NON-IP but we are trusting IP packets (via DSCP or IP-PRECEDENCE), then the switch will have no choice but to check other than DSCP or IP-PRECEDENCE. It will check the COS marking, which again, only available on trunk port. If there is no COS field available or if it is not an 802.1q/ISL, the packets will be marked with whatever the value in mls qos cos command, look at the COS-DSCP table, then mark it with the appropriate DSCP value. In this case DSCP CS1 (Decimal 8).SW-3560#sh mls qos int f0/1FastEthernet0/1trust state: trust dscptrust mode: trust dscptrust enabled flag: enaCOS override: disdefault COS: 1DSCP Mutation Map: Default DSCP Mutation MapTrust device: noneqos mode: port-based

On the other hand, mls qos trust cos will works for both IP and NON-IP packets marking. If there is a COS value in it, in this case has to be an 802.1q/ISL, it will uses

that COS value. If there is no COS value, it will use the mls qos cos 1 despite whatever DSCP/IP-PRECEDENCE value it already has. The switch will rewrite this DSCP/IP-PRECEDENCE based on the new COS value (COS 1).SW-3560#sh mls qos int f0/1FastEthernet0/1trust state: trust costrust mode: trust costrust enabled flag: enaCOS override: disdefault COS: 1DSCP Mutation Map: Default DSCP Mutation MapTrust device: noneqos mode: port-based

The mls qos cos 1 command itself will not change the COS value. To change or override it, mls qos cos override command is also required. This will override any COS value with whatever value nominated by mls qos cos 1 and deduce the DSCP value based on the COS-DSCP mapping table.SW-3560#sh mls qos int f0/1FastEthernet0/1trust state: cos overridetrust mode: cos overridetrust enabled flag: enaCOS override: enadefault COS: 1DSCP Mutation Map: Default DSCP Mutation MapTrust device: noneqos mode: port-based

Besides having mls qos cos command, we can use the MQC framework to perform the marking. This can be done as belowpolicy-map PM_QOS_MARKING class class-default set dscp cs1

int f0/1 switchport access vlan 100 service-policy in PM_QOS_MARKING

SW-3560#sh mls qos int f0/1FastEthernet0/1Attached policy-map for Ingress: PM_QOS_MARKINGtrust state: not trusted

trust mode: not trustedtrust enabled flag: enaCOS override: disdefault COS: 1DSCP Mutation Map: Default DSCP Mutation MapTrust device: noneqos mode: port-based

As shown above, we can use the MQC to mark any packet to DSCP CS1. Using this scenario we cannot use it to mark it as COS 1. Instead we can use DSCP CS1 and use DSCP-COS mapping tableSW-3560#sh mls qos maps dscp-cos Dscp-cos map: d1 : d2 0 1 2 3 4 5 6 7 8 9 --------------------------------------- 0 : 00 00 00 00 00 00 00 00 01 01 1 : 01 01 01 01 01 01 02 02 02 02 2 : 02 02 02 02 03 03 03 03 03 03 3 : 03 03 04 04 04 04 04 04 04 04 4 : 05 05 05 05 05 05 05 05 06 06 5 : 06 06 06 06 06 06 07 07 07 07 6 : 07 07 07 07

In this DSCP-COS map, we can see that DSCP CS1, read as decimal 08, has COS 1 mapped to it. Therefore, if the packet has 802.1q/ISL header, then the switch will rewrite it to COS 1.

We can alter this map like we alter cos-dscp map, but now we actually alter the dscp-cos map. Please note that changing cos-dscp map doesn’t automatically change dscp-cos map. These two maps are not linked to each other and keep its own mapping.

The DSCP-COS map above shows that DSCP EF (Decimal 46) has COS value of 5. We can change this value using the command belowSW-3560(config)#mls qos map dscp-cos 46 to 4SW-3560(config)#do sh mls qos map dscp-cos Dscp-cos map: d1 : d2 0 1 2 3 4 5 6 7 8 9 --------------------------------------- 0 : 00 00 00 00 00 00 00 00 01 01 1 : 01 01 01 01 01 01 02 02 02 02 2 : 02 02 02 02 03 03 03 03 03 03 3 : 03 03 04 04 04 04 04 04 04 04 4 : 05 05 05 05 05 05 04 05 06 06

5 : 06 06 06 06 06 06 07 07 07 07 6 : 07 07 07 07Let see another example below:int f0/1 switchport access vlan 100 switchport voice vlan 200 mls qos trust device cisco-phone

SW-3560#sh mls qos int f0/37FastEthernet0/37trust state: not trustedtrust mode: not trustedtrust enabled flag: enaCOS override: disdefault COS: 0DSCP Mutation Map: Default DSCP Mutation MapTrust device: cisco-phoneqos mode: port-based

The command mls qos trust device cisco-phone will trust the marking if the port can sense a Cisco-phone via CDPv2 or LLDP-Med. The port itself turns into a pseudo-trunk which carries 802.1q header and contains COS value. Again, this can also alter the DSCP value based on COS-DSCP mapping table. However, the switch will not trust the PC on the vlan 100 thus will rewrite it to COS 0 based on the switchport default COS value.

This also means that once you enable the mls qos globally, the switchport will rewrite any packets to COS 0 or DSCP default (decimal 0). If you want, you can change this default COS 0 value to mls qos cos 2 to mark the traffic that are not from known Cisco-phone

MQCWe can actually use MQC in line with the mls qos. This is when you need to differentiate several different traffic on vlan 100 and mark those traffic differently.ip access-list ext ACL_HTTP permit tcp any any eq wwwip access-list ext ACL_TELNET permit tcp any any eq telnet

class-map CM_HTTP match access-group name ACL_HTTPclass-map CM_TELNET match access-group name ACL_TELNET

policy-map PM_QOS_MARKING class CM_HTTP set dscp cs1 class CM_TELNET set dscp af41 class class-default set dscp cs1

int f0/1 switchport access vlan 100 switchport voice vlan 200 mls qos trust device cisco-phone service-policy input PM_QOS_MARKING

The above combination will trust the DSCP marking from the Cisco-phone and mark any HTTP packets on vlan 100 as CS1, TELNET as CS3, and the rest will be marked as DSCP cs1. Note that any other packet will not be marked as CS 0 as per the default COS value, this is because the matched class-default inside PM_QOS_MARKING is acting as a catch all. Unless there is no class-default inside the PM_QOS_MARKING, CS 0 will be used.

Also remember on the early paragraph I’ve showed that we cannot use mls qos dscpcommand, the only available marking is mls qos cos

The moral of this DSCP/IP-PRECEDENCE/COS confusion is basically quite simple. It doesn’t really matter what marking you’re trusting, as long as you have the map correctly adjusted then the switch can use both L2 and L3 marking.

Of course, it will make more sense if you trust COS on trunk ports and DSCP/IP-Prec on non-trunk port for efficiency, but again it doesn’t really matter as long as you have the mapping correctly adjusted.

Another example, you can trust DSCP (instead of COS) on your ingress trunk L2 switch from the dot1q WAN router interface. The reason for this is just merely because packet from the WAN doesn’t have any COS value in it.

This is it so far for Marking and Classification.

http://ideasnet.wordpress.com/2013/07/01/cisco-switch-applying-quality-of-service-qos-in-multi-layer-switching-mls-in-a-cisco-3560-part-1/

Ingress Queueing.

Once the traffic being marked and classified, packets go into Queues. There are cos-input-qfor L2-based marking queue and dscp-input-q for L3-based marking queue as shown below.SW-3560# sh mls qos maps cos-input-q Cos-inputq-threshold map: cos: 0 1 2 3 4 5 6 7 ------------------------------------ queue-threshold: 1-3 1-2 2-1 2-3 2-2 2-3 2-2 2-2

To change the cos-input-q map use command mls qos srr-queue input cos-map queue <Queue_Number> threshold <Threshold_Number> <COS_value>. Look at the example below.! put COS 1 to Q1T2mls qos srr-queue input cos-map queue 1 threshold 2 1

! put COS 0 to Q1T3mls qos srr-queue input cos-map queue 1 threshold 3 0

! put COS 2 to Q2T1mls qos srr-queue input cos-map queue 2 threshold 1 2

! put COS 4, 6, and 7 to Q2T2mls qos srr-queue input cos-map queue 2 threshold 2 4 6 7

! put COS 3 and 5 to Q2T3mls qos srr-queue input cos-map queue 2 threshold 3 3 5

SW-3560# sh mls qos maps cos-input-q Cos-inputq-threshold map: cos: 0 1 2 3 4 5 6 7 ------------------------------------ queue-threshold: 1-3 1-2 2-1 2-3 2-2 2-3 2-2 2-2

SW-3560#sh mls qos maps dscp-input-q Dscp-inputq-threshold map: d1 :d2 0 1 2 3 4 5 6 7 8 9 ------------------------------------------------------------ 0 : 01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-01 01-02 1 : 01-02 01-02 01-02 01-02 01-02 01-02 02-01 02-01 02-01 02-01 2 : 02-01 02-01 02-01 02-01 02-03 02-03 02-03 02-03 02-03 02-03 3 : 02-03 02-03 01-03 02-02 02-02 02-02 02-02 02-02 02-02 02-02 4 : 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-02 02-02 5 : 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02

6 : 02-02 02-02 02-02 02-02

To Change the dscp-input-q use command mls qos srr-queue input dscp-map queue <Queue_Number> threshold <Threshold_Number> <DSCP_DECIMAL_value>. Look at the example below.! put DSCP decimal 32 to Q1T3mls qos srr-queue input dscp-map queue 1 threshold 3 32

! put DSCP decimal 16, 17, 18, 19, 20, 21, 22, and 23 to Q2T1mls qos srr-queue input dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23

SW-3560#sh mls qos maps dscp-input-q Dscp-inputq-threshold map: d1 :d2 0 1 2 3 4 5 6 7 8 9 ------------------------------------------------------------ 0 : 01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-01 01-02 1 : 01-02 01-02 01-02 01-02 01-02 01-02 02-01 02-01 02-01 02-01 2 : 02-01 02-01 02-01 02-01 02-03 02-03 02-03 02-03 02-03 02-03 3 : 02-03 02-03 01-03 02-02 02-02 02-02 02-02 02-02 02-02 02-02 4 : 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-02 02-02 5 : 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 6 : 02-02 02-02 02-02 02-02Now let see what are those Q1 and Q2 are.SW-3560#sh mls qos input-queue Queue : 1 2----------------------------------------------buffers : 67 33bandwidth : 90 10priority : 0 10threshold1: 8 34threshold2: 16 66

From the above input-queue details, Q1T2 means that the Queue 1 can hold as much as Threshold 2 (which is 16 in this case) of Queue 1 Buffers 67. Once it reaches more than Threshold 16% of 67 Buffers, packets will be dropped. Buffers are the percentage value for each Queue.

For Q1T1, it will starts dropping packets once it reaches 8% of 67 Buffers.

So, what is the Threshold value For Q2T3? Threshold 3 will have 100% as default. Any Q uses T3 means that the packets will never get droppped. This makes sense why putting the DSCP EF packets or any other delay sensitive packets here.Start – Update June 13th, 2013.

Fromhttp://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND/QoSDesign.html

The Catalyst 2970/3560/3750 also supports two configurable ingress queues (normal and expedite). Ingress scheduling, however, is rarely—if ever—required, as it only becomes enabled if the combined input rates from any/all switch ports exceed the switch fabric’s capacity. Such cases are extremely difficult to achieve, even in controlled lab environments. In the extreme case where such a scenario develops in a production environment, the default settings of the ingress queues are acceptable to maintain VoIP quality and network availability.

End – Update June 13th, 2013.

Next is the Bandwidth parameters. This is the composition of how much of Q1 and Q2 can be transfered to the internal ring for the next process. Packets will be alternately taken from Q1 and Q2 and 90:10 described the weight composition for each Queue (not a percentage). This means the same with 18:2 or 9:1. For example, both Queue 1 and Queue 2 can take 1000 packets each, 900 will be transfered to the internal ring and 100 will be transfered to the internal ring. If Q1 is not fully occupied (e.g not using the 90 portion of it), the Q2 can transfer more than 10 portion from Q2.

The Priority however, will change the amount of packets taken from Q1 and Q2. Q2 (in this scenario) will be prioritized until it reaches maximum packets (100). Then the rest 900 will be shared between Q1 and Q2 for 810:90 as per 90:10 ratio.

Start – Update May 7th, 2013.For Example, For every 1000 packets coming in:

10% of it (100 packets) is prioritized out of 100% (1000 packets). 90% of it (900 packets is shared between Q1 and Q2 out of 100% (1000

packets). Out of that 90% (900 packets), 10% of it (90 packets) is for Q2 (addition to

10% priority), 90% (810 packets) is for Q1. Therefore for Q2 the total packets are 100 + 90 = 190 packets. 100 packets are

prioritized and minimum 90 packets are guaranteed. for the Q1 the total packets are minimum 810 packets guaranteed.

End – Update May 7th, 2013.Below are the example if you want to modify the input-queue.mls qos srr-queue input buffers 67 33mls qos srr-queue input bandwidth 90 10! NOTE. ! - max PQ BW is 40.

! - We can use Q2 or Q2 as PQ.mls qos srr-queue input priority-queue 2 bandwidth 10mls qos srr-queue input threshold 1 8 16mls qos srr-queue input threshold 2 34 66

SW-3560#sh mls qos input-queue Queue : 1 2----------------------------------------------buffers : 67 33bandwidth : 90 10priority : 0 10threshold1: 8 34threshold2: 16 66

Egress QueuingNow, it has come to the part where packets are ready to be sent out. The idea is quite similar with Ingress Queuing but Egress has 4 Queues instead of only 2 for Ingress. Unlike Ingress Queues, Egress Queues has two sets of Queue configuration templates. It is called Queue-set 1 and Queue-set 2. This can be handy if you require to have two different settings for access ports and trunk ports. You will be able to configure Queue-set 1 with particular setup and have another different setup for Queue-set 2.mls qos queue-set output 1 threshold 1 138 138 92 138mls qos queue-set output 1 threshold 2 138 138 92 400mls qos queue-set output 1 threshold 3 36 77 100 318mls qos queue-set output 1 threshold 4 20 50 67 400mls qos queue-set output 2 threshold 1 149 149 100 149mls qos queue-set output 2 threshold 2 118 118 100 235mls qos queue-set output 2 threshold 3 41 68 100 272mls qos queue-set output 2 threshold 4 42 72 100 242mls qos queue-set output 1 buffers 10 10 26 54mls qos queue-set output 2 buffers 16 6 17 61

SW-3560#sh mls qos queue-set Queueset: 1Queue : 1 2 3 4----------------------------------------------buffers : 10 10 26 54threshold1: 138 138 36 20threshold2: 138 138 77 50reserved : 92 92 100 67maximum : 138 400 318 400Queueset: 2

Queue : 1 2 3 4----------------------------------------------buffers : 16 6 17 61threshold1: 149 118 41 42threshold2: 149 118 68 72reserved : 100 100 100 100maximum : 149 235 272 242

Let’s take the example of Queue-set 1. Each Queue has been allocated as much as 10:10:26:54 for Q1, Q2, Q3, and Q4 respectively. Reserved is the maximum amount of the buffers can be used. So, Q4 has been allocated to be able to use 54% but limited to the 67% of the 54%, which is 54*.67=36.18%. But, this is just a reserved value for Q4, which can actually grow up to 400% provided there is enough memory available to borrow.

For T1 and T2, these are the threshold when the packets will start to get dropped (WTD), whichever configured. A little note for WTD here, it would be better to start dropping packets based on its Weighted value when the Queue reaches its threshold rather than waiting for the Queue to reach its maximum limit and dropping any packets, including high priority packets, trying to enter the Queue.

You can choose to use either Queue-set in the interface level using command queue-set <queue_number>SW-3560(config)#int f0/1SW-3560(config-if)#queue-set 2SW-3560(config-if)#^ZSW-3560#sh mls qos interface f0/1 Queuing FastEthernet0/1Egress Priority Queue : enabledShaped queue weights (absolute) : 10 0 0 0Shared queue weights : 1 10 60 20The port bandwidth limit : 100 (Operational Bandwidth:100.0)The port is mapped to qset : 2

From the above result, we can see that on port Fa0/1, the bandwidth is shared 10:60:20 for Q2, Q3, and Q4 respectively. You probably will think that Q1 is shaped to 10 and prioritized. No, Q1 can either be prioritized or shaped. If Q1 is prioritized, then the shaped 10 is irrelevant. We might as well to clean the config by making the shape to 0 0 0 0. This also means that once the Q1 is prioritized, there is no limit on how much Q1 can use up the bandwidth and might starve other traffic.

You can use the command below to set the SRR and the priority queue.SW-3560(config)#int f0/1

SW-3560(config-if)#srr-queue bandwidth share 1 10 60 20SW-3560(config-if)#srr-queue bandwidth shape 10 0 0 0SW-3560(config-if)#priority-queue outSW-3560(config-if)#do sh mls qos int f0/1 queueFastEthernet0/1Egress Priority Queue : enabledShaped queue weights (absolute) : 10 0 0 0Shared queue weights : 1 10 60 20The port bandwidth limit : 100 (Operational Bandwidth:100.0)The port is mapped to qset : 2

SW-3560(config-if)#srr-queue bandwidth shape 0 0 0 0 SW-3560(config-if)#do sh mls qos int f0/1 queue FastEthernet0/1Egress Priority Queue : enabledShaped queue weights (absolute) : 0 0 0 0Shared queue weights : 1 10 60 20The port bandwidth limit : 100 (Operational Bandwidth:100.0)The port is mapped to qset : 2

Egress Queues also have cos-output-q and dscp-output-q for L2 and L3 queue mapping, respectively.mls qos srr-queue output cos-map queue 1 threshold 3 5mls qos srr-queue output cos-map queue 2 threshold 3 3 6 7mls qos srr-queue output cos-map queue 3 threshold 3 2 4mls qos srr-queue output cos-map queue 4 threshold 2 1mls qos srr-queue output cos-map queue 4 threshold 3 0mls qos srr-queue output dscp-map queue 1 threshold 3 40 41 42 43 44 45 46 47mls qos srr-queue output dscp-map queue 2 threshold 3 24 25 26 27 28 29 30 31mls qos srr-queue output dscp-map queue 2 threshold 3 48 49 50 51 52 53 54 55mls qos srr-queue output dscp-map queue 2 threshold 3 56 57 58 59 60 61 62 63mls qos srr-queue output dscp-map queue 3 threshold 3 16 17 18 19 20 21 22 23mls qos srr-queue output dscp-map queue 3 threshold 3 32 33 34 35 36 37 38 39mls qos srr-queue output dscp-map queue 4 threshold 1 8mls qos srr-queue output dscp-map queue 4 threshold 2 9 10 11 12 13 14 15mls qos srr-queue output dscp-map queue 4 threshold 3 0 1 2 3 4 5 6 7

SW-3560#sh mls qos maps cos-output-q Cos-outputq-threshold map: cos: 0 1 2 3 4 5 6 7 ------------------------------------ queue-threshold: 4-3 4-2 3-3 2-3 3-3 1-3 2-3 2-3

SW-3560#sh mls qos maps dscp-output-q Dscp-outputq-threshold map: d1 :d2 0 1 2 3 4 5 6 7 8 9 ------------------------------------------------------------ 0 : 04-03 04-03 04-03 04-03 04-03 04-03 04-03 04-03 04-01 04-02 1 : 04-02 04-02 04-02 04-02 04-02 04-02 03-03 03-03 03-03 03-03 2 : 03-03 03-03 03-03 03-03 02-03 02-03 02-03 02-03 02-03 02-03 3 : 02-03 02-03 03-03 03-03 03-03 03-03 03-03 03-03 03-03 03-03 4 : 01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-03 02-03 02-03 5 : 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 6 : 02-03 02-03 02-03 02-03

For the Shared and Shaped Round-Robin, we have the option to share the bandwidth and limit (shape) it. srr-queue bandwidth share 10 10 60 20 will share the bandwidth evenly as much as 10:10:60:20 for Q1, Q2, Q3, and Q4, respectively. If either of the Queues not utilizing the shared bandwidth, other Queue can borrow the bandwidth above its minimum limit.

For the srr-queue bandwidth shaped 15 0 0 0 will limit the maximum bandwidth of Q1 up to 15 portion (no, this is not a percentage) from the shared X 10 60 20. When we put command srr-queue bandwidth shaped 15 0 0 0 this will render the first value of srr-queue bandwidth share X 10 60 20 useless. It is a good habit to put a minimum value to it to avoid confusion as shown below. srr-queue bandwidth share 1 10 60 20 srr-queue bandwidth shape 10 0 0 0

We can also prioritize the Q1 using command priority-queue out. This command will also render value of Q1 in Share/Shaped value useless. It is also recommended to put the minimum value for Q1 on Share/Shape as shown below. srr-queue bandwidth share 1 10 60 20 srr-queue bandwidth shape 0 0 0 0 priority-queue out

More Related to Cisco 3560 SeriesHow to Enable IPv6 Support on a Cisco Catalyst 3560 Switch?How to Configure the Cisco Catalyst 3560 Series Switches?How to Save/Keep the Cisco 3560 Switch Configuration?

Why Should We Care about Cisco 3560-E Series Switches ？