Applying quality of-service (qos) in multi-layer switching (mls) in a cisco 3560

Applying Quality-of-Service (QOS) in Multi-Layer Switching (MLS) ina Cisco 3560
MLS QOS has been one of the greatest fear for my CCIE RS exam. I’ve read it several
times, labbed it more than 3 times, but still I just cannot understand it. Then I decided
to write my own notes to teach myself and hopefully any of you mere mortals like me.
I’ll start with this Classification and Marking and let see how deep the rabbit hole
goes for the next few parts.
Classification and Marking
Let’s just say that you have a switchport Fa0/1 configured for Vlan 100 and want to
mark it as DSCP CS1 (Decimal 8).
SW-3560(config)#mlsqos
SW-3560(config)#int f0/1
SW-3560(config-if)#switchport access vlan 100
SW-3560(config-if)#mlsqos ?
coscos keyword
dscp-mutation dscp-mutation keyword
trusttrust keyword
vlan-basedvlan-based keyword
We only left with COS option and no DSCP option available. COS field can only be
found in 802.1q/ISL traffic which is the traffic on the trunk interface, and switchport
access is not a trunk interface. In this case, we can use the COS option and then the
switch will use the COS-DSCP mapping table to mark the packet as DSCP CS1
(Decimal 8).
SW-3560# shmlsqos maps cos-dscp
Cos-dscp map:
cos:
0 1 2 3 4 5 6 7
-------------------------------dscp:
0 8 16 24 32 40 48 56
We can actually change this mapping. For example, for most implementation we
would like to set COS 5 = DSCP EF (Decimal 46). This is to keep the uniformity from
end-to-end that DSCP EF (mostly for VOICE RTP) is mapped to COS 5.
SW-3560(config)#mlsqos map cos-dscp 0 8 16 24 32 46 48 56
SW-3560(config)#mlsqos map cos-dscp 0 8 16 24 32 46 48 56
SW-3560(config)#do shmlsqos map cos-dscp
Cos-dscp map:
cos:
0 1 2 3 4 5 6 7
-------------------------------dscp:
0 8 16 24 32 46 48 56
Based on the COS-DSCP map, to mark the packet to DSCP CS1 (Decimal 8), we can

usemlsqoscos 1.
SW-3560(config)#mlsqos
SW-3560(config-if)#switchport access vlan 100
SW-3560(config-if)#mlsqoscos 1
!
SW-3560#sh mlsqosint f0/1
FastEthernet0/1
trust state: not trusted
trust mode: not trusted
trust enabled flag: ena
COS override: dis
default COS: 1
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: none
qos mode: port-based
We can combine the mlsqoscos 1 with several commands below.
If the host is capable of marking the packets entering the switchport Fa0/1, we can
also honour its value by trusting its DSCP or IP-PRECEDENCE or COS marking.
For IP packets, we can use mlsqos trust dscp or mlsqos trust ip-precedence. If the
packets are NON-IP but we are trusting IP packets (via DSCP or IP-PRECEDENCE), then
the switch will have no choice but to check other than DSCP or IP-PRECEDENCE. It
will check the COS marking, which again, only available on trunk port. If there is no
COS field available or if it is not an 802.1q/ISL, the packets will be marked with
whatever the value in mlsqoscos command, look at the COS-DSCP table, then mark it
with the appropriate DSCP value. In this case DSCP CS1 (Decimal 8).
FastEthernet0/1
trust state: trust dscp
trust mode: trust dscp
COS override: dis
default COS: 1
Trust device: none
On the other hand, mlsqos trust cos will works for both IP and NON-IP packets
marking. If there is a COS value in it, in this case has to be an 802.1q/ISL, it will uses
that COS value. If there is no COS value, it will use the mlsqoscos 1 despite whatever

DSCP/IP-PRECEDENCE value it already has. The switch will rewrite this
DSCP/IP-PRECEDENCE based on the new COS value (COS 1).
FastEthernet0/1
trust state: trust cos
trust mode: trust cos
COS override: dis
default COS: 1
Trust device: none
The mlsqoscos 1 command itself will not change the COS value. To change or
override it, mlsqoscos override command is also required. This will override any COS
value with whatever value nominated by mlsqoscos 1 and deduce the DSCP value
based on the COS-DSCP mapping table.
FastEthernet0/1
trust state: cos override
trust mode: cos override
COS override: ena
default COS: 1
Trust device: none
Besides having mlsqoscos command, we can use the MQC framework to perform the
marking. This can be done as below
policy-map PM_QOS_MARKING
class class-default
setdscp cs1
int f0/1
switchport access vlan 100
service-policy in PM_QOS_MARKING
FastEthernet0/1
Attached policy-map for Ingress: PM_QOS_MARKING

COS override: dis
default COS: 1
Trust device: none
As shown above, we can use the MQC to mark any packet to DSCP CS1. Using this
scenario we cannot use it to mark it as COS 1. Instead we can use DSCP CS1 and use
DSCP-COS mapping table
SW-3560#sh mlsqos maps dscp-cos
Dscp-cos map:
d1 : d2 0 1 2 3 4 5 6 7 8 9
--------------------------------------0:
00 00 00 00 00 00 00 00 01 01
1:
01 01 01 01 01 01 02 02 02 02
2:
02 02 02 02 03 03 03 03 03 03
3:
03 03 04 04 04 04 04 04 04 04
4:
05 05 05 05 05 05 05 05 06 06
5:
06 06 06 06 06 06 07 07 07 07
6:
07 07 07 07
In this DSCP-COS map, we can see that DSCP CS1, read as decimal 08, has COS 1
mapped to it. Therefore, if the packet has 802.1q/ISL header, then the switch will
rewrite it to COS 1.
We can alter this map like we alter cos-dscp map, but now we actually alter the
dscp-cos map. Please note that changing cos-dscp map doesn’t automatically change
dscp-cos map. These two maps are not linked to each other and keep its own
mapping.
The DSCP-COS map above shows that DSCP EF (Decimal 46) has COS value of 5. We
can change this value using the command below
SW-3560(config)#mlsqos map dscp-cos 46 to 4
SW-3560(config)#do shmlsqos map dscp-cos
Dscp-cos map:
d1 : d2 0 1 2 3 4 5 6 7 8 9
--------------------------------------0:
00 00 00 00 00 00 00 00 01 01
1:
01 01 01 01 01 01 02 02 02 02
2:
02 02 02 02 03 03 03 03 03 03
3:
03 03 04 04 04 04 04 04 04 04
4:
05 05 05 05 05 05 04 05 06 06

5:
06 06 06 06 06 06 07 07 07 07
6:
07 07 07 07
Let see another example below:
int f0/1
switchport voice vlan 200
mlsqos trust device cisco-phone
FastEthernet0/37
COS override: dis
default COS: 0
Trust device: cisco-phone
The command mlsqos trust device cisco-phone will trust the marking if the port can
sense a Cisco-phone via CDPv2 or LLDP-Med. The port itself turns into a
pseudo-trunk which carries 802.1q header and contains COS value. Again, this can
also alter the DSCP value based on COS-DSCP mapping table. However, the switch
will not trust the PC on the vlan 100 thus will rewrite it to COS 0 based on the
switchport default COS value.
This also means that once you enable the mlsqos globally, the switchport will rewrite
any packets to COS 0 or DSCP default (decimal 0). If you want, you can change this
default COS 0 value to mlsqoscos 2 to mark the traffic that are not from known
Cisco-phone
MQC
We can actually use MQC in line with the mlsqos. This is when you need to
differentiate several different traffic on vlan 100 and mark those traffic differently.
ip access-list ext ACL_HTTP
permittcp any anyeq www
ip access-list ext ACL_TELNET
permit tcp any anyeq telnet
class-map CM_HTTP
match access-group name ACL_HTTP
class-map CM_TELNET
match access-group name ACL_TELNET

policy-map PM_QOS_MARKING
class CM_HTTP
setdscp cs1
class CM_TELNET
setdscp af41
class class-default
setdscp cs1
int f0/1
switchport voice vlan 200
mlsqos trust device cisco-phone
service-policy input PM_QOS_MARKING
The above combination will trust the DSCP marking from the Cisco-phone and mark
any HTTP packets on vlan 100 as CS1, TELNET as CS3, and the rest will be marked as
DSCP cs1. Note that any other packet will not be marked as CS 0 as per the default
COS value, this is because the matched class-default inside PM_QOS_MARKING is
acting as a catch all. Unless there is no class-default inside the PM_QOS_MARKING,
CS 0 will be used.
Also remember on the early paragraph I’ve showed that we cannot
use mlsqosdscpcommand, the only available marking is mlsqoscos
The moral of this DSCP/IP-PRECEDENCE/COS confusion is basically quite simple. It
doesn’t really matter what marking you’re trusting, as long as you have the map
correctly adjusted then the switch can use both L2 and L3 marking.
Of course, it will make more sense if you trust COS on trunk ports and
DSCP/IP-Precon non-trunk port for efficiency, but again it doesn’t really matter as
long as you have the mapping correctly adjusted.
Another example, you can trust DSCP (instead of COS) on your ingress trunk L2
switch from the dot1q WAN router interface. The reason for this is just merely
because packet from the WAN doesn’t have any COS value in it.
This is it so far for Marking and Classification.
http://ideasnet.wordpress.com/2013/07/01/cisco-switch-applying-quality-of-serviceqos-in-multi-layer-switching-mls-in-a-cisco-3560-part-1/
Ingress Queueing.

Once the traffic being marked and classified, packets go into Queues. There
are cos-input-qfor L2-based marking queue and dscp-input-q for L3-based marking
queue as shown below.
SW-3560# shmlsqos maps cos-input-q
Cos-inputq-threshold map:
cos: 0 1
2 3
4 5
6
7
-----------------------------------queue-threshold: 1-3 1-2 2-1 2-3 2-2 2-3 2-2 2-2
To change the cos-input-q map use command mlsqossrr-queue input cos-map queue
<Queue_Number> threshold <Threshold_Number><COS_value>. Look at the
example below.
! put COS 1 to Q1T2
mlsqossrr-queue input cos-map queue 1 threshold 2 1
! put COS 0 to Q1T3
! put COS 2 to Q2T1
! put COS 4, 6, and 7 to Q2T2
mlsqossrr-queue input cos-map queue 2 threshold 2 4 6 7
! put COS 3 and 5 to Q2T3
mlsqossrr-queue input cos-map queue 2 threshold 3 3 5
SW-3560# shmlsqos maps cos-input-q
Cos-inputq-threshold map:
cos: 0 1
2 3
4 5
6
7
-----------------------------------queue-threshold: 1-3 1-2 2-1 2-3 2-2 2-3 2-2 2-2
SW-3560#sh mlsqos maps dscp-input-q
Dscp-inputq-threshold map:
d1 :d2
0
1
2
3
4
5
6
7
8
-----------------------------------------------------------0:
01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-01 01-02
1:
01-02 01-02 01-02 01-02 01-02 01-02 02-01 02-01 02-01 02-01
2:
02-01 02-01 02-01 02-01 02-03 02-03 02-03 02-03 02-03 02-03
3:
02-03 02-03 01-03 02-02 02-02 02-02 02-02 02-02 02-02 02-02
4:
02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-02 02-02
5:
02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02

9

6:

02-02 02-02 02-02 02-02

To Change the dscp-input-q use command mlsqossrr-queue input dscp-map queue
<Queue_Number> threshold <Threshold_Number><DSCP_DECIMAL_value>. Look at
the example below.
! put DSCP decimal 32 to Q1T3
mlsqossrr-queue input dscp-map queue 1 threshold 3 32
! put DSCP decimal 16, 17, 18, 19, 20, 21, 22, and 23 to Q2T1
mlsqossrr-queue input dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23
SW-3560#sh mlsqos maps dscp-input-q
Dscp-inputq-threshold map:
d1 :d2
0
1
2
3
4
5
6
7
8
-----------------------------------------------------------0:
01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-01 01-02
1:
01-02 01-02 01-02 01-02 01-02 01-02 02-01 02-01 02-01 02-01
2:
02-01 02-01 02-01 02-01 02-03 02-03 02-03 02-03 02-03 02-03
3:
02-03 02-03 01-03 02-02 02-02 02-02 02-02 02-02 02-02 02-02
4:
02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-02 02-02
5:
02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02 02-02
6:
02-02 02-02 02-02 02-02
Now let see what are those Q1 and Q2 are.
SW-3560#sh mlsqos input-queue
Queue
:
1
2
---------------------------------------------buffers
:
67
33
bandwidth :
90
10
priority :
0
10
threshold1:
8
34
threshold2:
16
66

9

From the above input-queue details, Q1T2 means that the Queue 1 can hold as much
as Threshold 2 (which is 16 in this case) of Queue 1 Buffers 67. Once it reaches more
than Threshold 16% of 67 Buffers, packets will be dropped. Buffers are the
percentage value for each Queue.
For Q1T1, it will starts dropping packets once it reaches 8% of 67 Buffers.
So, what is the Threshold value For Q2T3? Threshold 3 will have 100% as default. Any
Q uses T3 means that the packets will never get droppped. This makes sense why
putting the DSCP EF packets or any other delay sensitive packets here.
Start – Update June 13th, 2013.

Fromhttp://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/QoS_
SRND/QoSDesign.html
The Catalyst 2970/3560/3750 also supports two configurable ingress queues (normal
and expedite). Ingress scheduling, however, is rarely—if ever—required, as it only
becomes enabled if the combined input rates from any/all switch ports exceed the
switch fabric’s capacity. Such cases are extremely difficult to achieve, even in
controlled lab environments. In the extreme case where such a scenario develops in
a production environment, the default settings of the ingress queues are acceptable
to maintain VoIP quality and network availability.
End – Update June 13th, 2013.
Next is the Bandwidth parameters. This is the composition of how much of Q1 and
Q2 can be transfered to the internal ring for the next process. Packets will be
alternately taken from Q1 and Q2 and 90:10 described the weight composition for
each Queue (not a percentage). This means the same with 18:2 or 9:1. For example,
both Queue 1 and Queue 2 can take 1000 packets each, 900 will be transfered to the
internal ring and 100 will be transfered to the internal ring. If Q1 is not fully occupied
(e.g not using the 90 portion of it), the Q2 can transfer more than 10 portion from
Q2.
The Priority however, will change the amount of packets taken from Q1 and Q2. Q2
(in this scenario) will be prioritized until it reaches maximum packets (100). Then the
rest 900 will be shared between Q1 and Q2 for 810:90 as per 90:10 ratio.
Start – Update May 7th, 2013.
For Example, For every 1000 packets coming in:
10% of it (100 packets) is prioritized out of 100% (1000 packets).
90% of it (900 packets is shared between Q1 and Q2 out of 100% (1000
packets).
Out of that 90% (900 packets), 10% of it (90 packets) is for Q2 (addition to 10%
priority), 90% (810 packets) is for Q1.
Therefore for Q2 the total packets are 100 + 90 = 190 packets. 100 packets are
prioritized and minimum 90 packets are guaranteed.
for the Q1 the total packets are minimum 810 packets guaranteed.
End – Update May 7th, 2013.
Below are the example if you want to modify the input-queue.
mlsqossrr-queue input buffers 67 33
mlsqossrr-queue input bandwidth 90 10
! NOTE.
! - max PQ BW is 40.

! - We can use Q2 or Q2 as PQ.
mlsqossrr-queue input priority-queue 2 bandwidth 10
mlsqossrr-queue input threshold 1 8 16
mlsqossrr-queue input threshold 2 34 66
SW-3560#sh mlsqos input-queue
Queue
:
1
2
---------------------------------------------buffers
:
67
33
bandwidth :
90
10
priority :
0
10
threshold1:
8
34
threshold2:
16
66
Egress Queuing
Now, it has come to the part where packets are ready to be sent out. The idea is
quite similar with Ingress Queuing but Egress has 4 Queues instead of only 2 for
Ingress. Unlike Ingress Queues, Egress Queues has two sets of Queue configuration
templates. It is called Queue-set 1 and Queue-set 2. This can be handy if you require
to have two different settings for access ports and trunk ports. You will be able to
configure Queue-set 1 with particular setup and have another different setup for
Queue-set 2.
mlsqos queue-set output 1 threshold 1 138 138 92 138
mlsqos queue-set output 1 buffers 10 10 26 54
mlsqos queue-set output 2 buffers 16 6 17 61
SW-3560#sh mlsqos queue-set
Queueset: 1
Queue
:
1
2
---------------------------------------------buffers
:
10
10
threshold1:
138
138
threshold2:
138
138
reserved :
92
92
maximum
:
138
400
Queueset: 2

3
26
36
77
100
318

4
54
20
50
67
400

Queue
:
1
2
---------------------------------------------buffers
:
16
6
threshold1:
149
118
threshold2:
149
118
reserved :
100
100
maximum
:
149
235

3
17
41
68
100
272

4
61
42
72
100
242

Let’s take the example of Queue-set 1. Each Queue has been allocated as much as
10:10:26:54 for Q1, Q2, Q3, and Q4 respectively. Reserved is the maximum amount
of the buffers can be used. So, Q4 has been allocated to be able to use 54% but
limited to the 67% of the 54%, which is 54*.67=36.18%. But, this is just a reserved
value for Q4, which can actually grow up to 400% provided there is enough memory
available to borrow.
For T1 and T2, these are the threshold when the packets will start to get dropped
(WTD), whichever configured. A little note for WTD here, it would be better to start
dropping packets based on its Weighted value when the Queue reaches its threshold
rather than waiting for the Queue to reach its maximum limit and dropping any
packets, including high priority packets, trying to enter the Queue.
You can choose to use either Queue-set in the interface level using
command queue-set <queue_number>
SW-3560(config-if)#queue-set 2
SW-3560(config-if)#^Z
SW-3560#sh mlsqos interface f0/1 Queuing
FastEthernet0/1
Egress Priority Queue : enabled
Shaped queue weights (absolute) : 10 0 0 0
Shared queue weights : 1 10 60 20
The port bandwidth limit : 100 (Operational Bandwidth:100.0)
The port is mapped to qset : 2
From the above result, we can see that on port Fa0/1, the bandwidth is shared
10:60:20 for Q2, Q3, and Q4 respectively. You probably will think that Q1 is shaped to
10 and prioritized. No, Q1 can either be prioritized or shaped. If Q1 is prioritized,
then the shaped 10 is irrelevant. We might as well to clean the config by making the
shape to 0 0 0 0. This also means that once the Q1 is prioritized, there is no limit on
how much Q1 can use up the bandwidth and might starve other traffic.
You can use the command below to set the SRR and the priority queue.

SW-3560(config-if)#srr-queue bandwidth share 1 10 60 20
SW-3560(config-if)#srr-queue bandwidth shape 10 0 0 0
SW-3560(config-if)#priority-queue out
SW-3560(config-if)#do shmlsqosint f0/1 queue
FastEthernet0/1
Shaped queue weights (absolute) : 10 0 0 0
SW-3560(config-if)#srr-queue bandwidth shape 0 0 0 0
SW-3560(config-if)#do shmlsqosint f0/1 queue
FastEthernet0/1
Shaped queue weights (absolute) :0 0 0 0
Egress Queues also have cos-output-q and dscp-output-q for L2 and L3 queue
mapping, respectively.
mlsqossrr-queue output cos-map queue 1 threshold 3 5
mlsqossrr-queue output cos-map queue 2 threshold 3 3 6 7
mlsqossrr-queue output cos-map queue 3 threshold 3 2 4
mlsqossrr-queue output dscp-map queue 1 threshold 3 40 41 42 43 44 45 46 47
mlsqossrr-queue output dscp-map queue 4 threshold 1 8
mlsqossrr-queue output dscp-map queue 4 threshold 2 9 10 11 12 13 14 15
SW-3560#sh mlsqos maps cos-output-q
Cos-outputq-threshold map:
cos: 0 1
2 3
4 5
6
7
-----------------------------------queue-threshold: 4-3 4-2 3-3 2-3 3-3 1-3 2-3 2-3

SW-3560#sh mlsqos maps dscp-output-q
Dscp-outputq-threshold map:
d1 :d2
0
1
2
3
4
5
6
7
8
-----------------------------------------------------------0:
04-03 04-03 04-03 04-03 04-03 04-03 04-03 04-03 04-01 04-02
1:
04-02 04-02 04-02 04-02 04-02 04-02 03-03 03-03 03-03 03-03
2:
03-03 03-03 03-03 03-03 02-03 02-03 02-03 02-03 02-03 02-03
3:
02-03 02-03 03-03 03-03 03-03 03-03 03-03 03-03 03-03 03-03
4:
01-03 01-03 01-03 01-03 01-03 01-03 01-03 01-03 02-03 02-03
5:
02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03 02-03
6:
02-03 02-03 02-03 02-03

9

For the Shared and Shaped Round-Robin, we have the option to share the bandwidth
and limit (shape) it. srr-queue bandwidth share 10 10 60 20 will share the bandwidth
evenly as much as 10:10:60:20 for Q1, Q2, Q3, and Q4, respectively. If either of the
Queues not utilizing the shared bandwidth, other Queue can borrow the bandwidth
above its minimum limit.
For the srr-queue bandwidth shaped 15 0 0 0 will limit the maximum bandwidth of
Q1 up to 15 portion (no, this is not a percentage) from the shared X 10 60 20. When
we put command srr-queue bandwidth shaped 15 0 0 0 this will render the first value
of srr-queue bandwidth share X 10 60 20 useless. It is a good habit to put a minimum
value to it to avoid confusion as shown below.
srr-queue bandwidth share 1 10 60 20
srr-queue bandwidth shape 10 0 0 0
We can also prioritize the Q1 using command priority-queue out. This command will
also render value of Q1 in Share/Shaped value useless. It is also recommended to put
the minimum value for Q1 on Share/Shape as shown below.
srr-queue bandwidth share 1 10 60 20
srr-queue bandwidth shape 0 0 0 0
priority-queue out
More Related to Cisco 3560 Series
How to Enable IPv6 Support on a Cisco Catalyst 3560 Switch?
How to Configure the Cisco Catalyst 3560 Series Switches?
How to Save/Keep the Cisco 3560 Switch Configuration?
Why Should We Care about Cisco 3560-E Series Switches？

Applying quality of-service (qos) in multi-layer switching (mls) in a cisco 3560

Recommended

Recommended

More Related Content

More from IT Tech

More from IT Tech (20)

Recently uploaded

Recently uploaded (20)

Applying quality of-service (qos) in multi-layer switching (mls) in a cisco 3560