Content

| 8.3 |  | Classification at the Access Layer |
| 8.3.6 |  | Using a MAC ACL to assign a DSCP value |

It is not always possible to classify the CoS of a frame, based on an ingress port. An example of where ingress port classification would be a problem is where an ingress port is connected to multiple hosts through a hub or a simple workgroup switch that does not support QoS classification.

An IP access list could be a way of identifying traffic. However, this would limit QoS classification to IP traffic only. IP access lists are also problematic when equipment must move between VLANs or when the IP address is dynamically allocated, such as DHCP. In this case, a possible solution would be to use a Layer 2 MAC based ACL.

The syntax for a MAC ACL is similar to that required for an IP based ACL.

> Switch(config)#mac access-list extended name

However, in the QoS context, the permit and deny actions in the access control entries (ACEs) have different meanings than with security ACLs:

- If a match with a permit action is encountered, known as the first-match principle, the specified QoS-related action is taken.
- If a match with a deny action is encountered, the ACL being processed is skipped, and the next ACL is processed.
- If no match with a permit action is encountered and all the ACLs have been examined, no QoS processing occurs on the packet.
- If multiple ACLs are configured on an interface, the lookup stops after the packet matches the first ACL with a permit action, and QoS processing begins.

> Note: When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if no match is found before reaching the end.

After a traffic class has been defined with a MAC based ACL, a policy can be attached to that class. A policy can contain multiple classes with different QoS actions specified for each one of them. For classification purposes, the policy-class could be used to set a CoS at Layer 2 or DSCP at Layer 3.