A network is deployed using recommended practices of the enterprise campus network model,
including users with desktop computers connected via IP phones. Given that all components are
QoS-capable, where are the two optimal locations for trust boundaries to be configured by the
network administrator? (Choose two.)
A.
host
B.
IP phone
C.
access layer switch
D.
distribution layer switch
E.
core layer switch
Explanation:
In the current campus QoS design, the access ports of each switch are configured to not trust the
QoS markings of any traffic arriving on that port—unless it is on the auxiliary or voice VLAN and
the switch has detected that there is a phone (trusted device) on that VLAN. The decision to trust
or not trust the endpoints traffic is binary; either the traffic is from the phone and trusted or from
any other device and not trusted. This model works well in an environment with dedicated phones,
but as the trends in Unified Communications continue and voice/video applications start merging
with other PC applications, the need to selectively and intelligently trust certain application flows
from the untrusted PC is becoming necessary. The use of per VLAN and per port traffic policers is
one mechanism that is used to selectively trust traffic in certain port ranges and at certain data
rates. Each edge port can be configured to detect traffic within a specific port range and, for all
traffic that is less than a defined normal rate, mark that traffic with the correct DSCP values. All
traffic in excess of this rate is dropped, which provides a safety mechanism to protect against one
application masquerading as another more mission critical one (by using the more important
application’s port numbers for communication). While this policer-based approach has proven to
work well and is still valid for certain environments, the increasingly complex list of applications
that share port numbers and applications that might be hijacking other applications trusted port
ranges requires that we consider a more sophisticated approach.
Reference:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/campover.html#wp709277
