Content

| 8.3 |  | Classification at the Access Layer |
| 8.3.7 |  | Configuring DSCP using a MAC ACL |

In this example, a MAC ACL is used to set the DSCP field of packets coming from a single IP-Phone, called receptionphone, within a switched network.

Given that the MAC address of the IP-Phone is known to be 000.0a00.0111 a MAC ACL can be configured to identify traffic sourced from this device.

> Switch(config)#mac access-list extended receptionphone
> Switch(config-ext-macl)#permit host 000.0a00.0111 any
> Switch(config-ext-macl)#exit

The creation of the access-list can be verified with the show access-lists command.

> Switch#show access-lists

> Extended MAC access list receptionphone permit host 0000.0a00.0111 any

Once the traffic is identified, a class-map is used to link the identified traffic to a particular class of service. In this case, a class of service called “ipphone” is created.

> Switch(config)#class-map match-all ipphone
> Switch(config-cmap)#match access-group name receptionphone

The creation of the class-map can be verified with the show class-map command:

> Switch#show class-map
> Class Map match-any class-default (id 0)
> Match any
> Class Map match-all ipphone (id 2)
> Match access-group name receptionphone

Now that the traffic is classified, a policy map is used to define the action that should be taken on any traffic that forms part of that class. In this case, the policy will be called “inbound-accesslayer” and the action is to set DSCP for the packets to 40.

> Switch(config)#policy-map inbound-accesslayer
> Switch(config-pmap)#class ipphone
> Switch(config-pmap-c)#set ip dscp 40

The show policy-map command can be used to verify any policy-map configuration.

> Switch#show policy-map
> Policy Map inbound-accesslayer
> class ipphone
> set ip dscp 40

Now that the action to be taken on packets coming from the IP-Phone is defined, the only remaining step is to tell the switch to apply the policy to the appropriate interface. In this case, the policy will be applied to all the interfaces so that QoS will be maintained regardless of the interface the IP-Phone is connected to.

> Switch(config)#interface range fastethernet 0/1 - 24
> Switch(config-if-range)#service-policy input inbound-accesslayer

The show mls qos interface command can be used to determine the policies that are bound to a particular interface on the switch.

> Switch#show mls qos interface fastethernet 0/1
> FastEthernet0/1
> Attached policy-map for Ingress: inbound-accesslayer
> trust state: not trusted
> trust mode: not trusted
> COS override: dis
> default COS: 0
> pass-through: none
> trust device: none