mls qos
Enables QoS globally on a Catalyst switch and enters MLS QoS configuration mode to configure trust settings, queueing, and policing.
Definition: mls qos is a Cisco IOS global config command. Enables QoS globally on a Catalyst switch and enters MLS QoS configuration mode to configure trust settings, queueing, and policing.
Overview
The `mls qos` command is a fundamental global configuration command on Cisco Catalyst switches that enables the Multilayer Switching (MLS) Quality of Service (QoS) feature. When issued, it activates the switch's hardware-based QoS engine, allowing the device to classify, mark, police, and queue traffic based on Layer 2 (CoS), Layer 3 (IP precedence or DSCP), or other criteria. Without this command, the switch operates in a best-effort mode, treating all packets equally, which can lead to poor performance for delay-sensitive applications like voice and video.
This command is the first step in any QoS deployment on Catalyst switches; it must be enabled before configuring trust boundaries, shaping, policing, or queueing policies. The command is available in global configuration mode and does not require any additional parameters—simply typing `mls qos` turns on the QoS feature. Once enabled, the switch begins to honor the default trust settings (typically untrusted on access ports) and allows the configuration of more advanced QoS policies.
It is important to note that `mls qos` is a per-switch command; it affects all interfaces on the switch. The command is supported on most Catalyst switches running IOS, including the 2960, 3560, 3750, 3850, and 4500 series. On newer platforms running IOS-XE (e.g., Catalyst 9300), the equivalent command is `qos` under the global configuration, but `mls qos` is still accepted for backward compatibility.
The command does not have any parameters; it is a simple toggle. When you issue `no mls qos`, QoS is disabled globally, and all QoS configurations are removed from the running configuration. This command is typically used in enterprise networks where traffic prioritization is required, such as in VoIP deployments, video conferencing, or when implementing strict service-level agreements (SLAs).
It fits into the broader QoS workflow: first, enable `mls qos` globally; second, configure trust boundaries on interfaces (e.g., `mls qos trust cos`); third, define class maps and policy maps for classification and policing; fourth, apply service policies to interfaces. The command is also used in troubleshooting scenarios where QoS behavior is unexpected—checking if `mls qos` is enabled is often the first step. A common mistake is forgetting to enable `mls qos` before applying QoS policies; the policies will be accepted in the configuration but will not take effect until the global command is issued.
Another important behavior is that `mls qos` is saved in the running configuration and startup configuration; it persists across reloads. The command does not require any special privilege level beyond the standard 15 (enable mode). When enabled, the switch's QoS hardware resources are allocated, which may impact performance if too many policies are applied.
In summary, `mls qos` is the gateway to all QoS features on Catalyst switches and is essential for any network engineer deploying QoS in a campus or data center environment.
mls qosWhen to Use This Command
- Enable QoS on a switch to prioritize VoIP traffic over data traffic.
- Configure trust boundaries to preserve DSCP markings from IP phones.
- Implement egress queue scheduling for different traffic classes.
- Apply ingress policing to limit traffic from untrusted ports.
Command Examples
Enable QoS and set trust to DSCP
mls qos
interface GigabitEthernet0/1
mls qos trust dscpSwitch(config)# mls qos Switch(config)# interface GigabitEthernet0/1 Switch(config-if)# mls qos trust dscp Switch(config-if)# end Switch# show mls qos interface GigabitEthernet0/1 GigabitEthernet0/1 trust state: trust dscp trust mode: trust dscp COS override: dis default COS: 0 DSCP mutation map: default dscp mutation trust device: none qos mode: port-based
Line 1: 'trust state: trust dscp' indicates the port trusts incoming DSCP values. Line 2: 'trust mode: trust dscp' confirms the trust mode. Line 3: 'COS override: dis' means COS override is disabled. Line 4: 'default COS: 0' is the default COS if no trust. Line 5: DSCP mutation map shows the map applied. Line 6: 'trust device: none' means no device trust. Line 7: 'qos mode: port-based' indicates per-port QoS.
Enable QoS with trust COS and set queueing
mls qos
interface GigabitEthernet0/2
mls qos trust cos
mls qos cos 5
mls qos queue-set output 1 buffers 10 30 30 30
mls qos queue-set output 1 threshold 1 80 100Switch(config)# mls qos
Switch(config)# interface GigabitEthernet0/2
Switch(config-if)# mls qos trust cos
Switch(config-if)# mls qos cos 5
Switch(config-if)# mls qos queue-set output 1 buffers 10 30 30 30
Switch(config-if)# mls qos queue-set output 1 threshold 1 80 100
Switch(config-if)# end
Switch# show mls qos interface GigabitEthernet0/2 queueing
GigabitEthernet0/2
Egress expedite queue: dis
WRR bandwidth ratios: 1[queue 1] 2[queue 2] 3[queue 3] 4[queue 4]
queue-limit ratios: 10[queue 1] 30[queue 2] 30[queue 3] 30[queue 4]
queue thresh buffers:
queue 1: 80 100
queue 2: 80 100
queue 3: 80 100
queue 4: 80 100Line 1: 'Egress expedite queue: dis' shows no strict priority queue. Line 2: WRR bandwidth ratios show the weight for each queue. Line 3: queue-limit ratios show the buffer allocation per queue. Lines 4-7: queue thresh buffers show the drop thresholds (first number is the minimum threshold, second is the maximum).
Understanding the Output
The 'show mls qos interface' command displays QoS trust state, mode, COS override, default COS, DSCP mutation map, trust device, and QoS mode. 'trust state' indicates whether the port trusts markings (trust dscp, trust cos, or untrusted). 'trust mode' shows the configured trust type.
'COS override' shows if COS override is enabled. 'default COS' is the COS assigned to untrusted frames. 'DSCP mutation map' shows the map used for DSCP translation.
'trust device' indicates if a specific device (e.g., Cisco IP phone) is trusted. 'qos mode' shows whether QoS is port-based or VLAN-based. For queueing, 'show mls qos interface queueing' shows egress queue settings: expedite queue status, WRR bandwidth ratios, queue-limit ratios, and threshold values.
Good values: trust dscp for IP phones, proper queue allocation for voice queues (e.g., queue 1 with high priority). Watch for: 'trust state: untrusted' when trust should be enabled, or 'qos mode: vlan-based' when port-based is expected.
Configuration Scenarios
Enable QoS Globally on a Catalyst 2960 Switch for VoIP Deployment
A company is deploying VoIP phones and needs to prioritize voice traffic over data traffic. The switch must trust the CoS markings from the IP phones and apply strict priority queuing for voice packets.
Topology
IP Phone --- (Fa0/1) Switch (Gi0/1) --- RouterSteps
- 1.Step 1: Enter global configuration mode: Switch# configure terminal
- 2.Step 2: Enable MLS QoS globally: Switch(config)# mls qos
- 3.Step 3: Configure the interface connected to the IP phone to trust CoS: Switch(config)# interface FastEthernet0/1
- 4.Step 4: Set the trust state to CoS: Switch(config-if)# mls qos trust cos
- 5.Step 5: (Optional) Configure the egress queue to give priority to CoS 5: Switch(config)# mls qos srr-queue output cos-map queue 1 threshold 3 5
- 6.Step 6: Exit and save configuration: Switch(config-if)# end; Switch# copy running-config startup-config
! mls qos ! interface FastEthernet0/1 mls qos trust cos ! mls qos srr-queue output cos-map queue 1 threshold 3 5 !
Verify: Use `show mls qos interface FastEthernet0/1` to verify that trust is set to CoS. Expected output includes 'trust state: trust cos'.
Watch out: If the IP phone is not configured to mark CoS, the switch will not prioritize voice traffic. Ensure the phone is set to mark voice packets with CoS 5.
Disable QoS on a Catalyst 3750 Switch for Troubleshooting
A network engineer suspects that QoS policies are causing packet drops or performance issues. To isolate the problem, QoS must be temporarily disabled globally.
Topology
Switch (Gi0/1) --- Server FarmSteps
- 1.Step 1: Enter global configuration mode: Switch# configure terminal
- 2.Step 2: Disable MLS QoS globally: Switch(config)# no mls qos
- 3.Step 3: Verify that QoS is disabled: Switch(config)# end; Switch# show mls qos
- 4.Step 4: (Optional) Re-enable QoS after troubleshooting: Switch(config)# mls qos
! no mls qos !
Verify: Use `show mls qos` to confirm that QoS is disabled. Expected output: 'QoS is disabled globally' or similar.
Watch out: Disabling `mls qos` removes all QoS configurations from the running configuration. If you plan to re-enable it later, save the configuration before disabling.
Troubleshooting with This Command
When troubleshooting QoS issues on a Catalyst switch, the first command to verify is `show mls qos`. This command displays the global QoS state: enabled or disabled. If QoS is disabled, no QoS policies will take effect, even if they are configured on interfaces.
A healthy output shows 'QoS is enabled globally'. If it shows disabled, simply enable it with `mls qos` in global configuration mode. Another common symptom is that traffic is not being marked or queued as expected.
In such cases, use `show mls qos interface <interface>` to check the trust state and the number of packets marked or dropped. For example, if an interface is configured to trust DSCP but the output shows 'trust state: not trusted', the switch is not honoring the markings. This could be because the interface is an access port and the default trust is untrusted.
To fix, configure `mls qos trust dscp` on the interface. If you see high drop counts on a particular queue, use `show mls qos interface <interface> statistics` to examine queue depths and drop counters. For policing issues, `show policy-map interface <interface>` shows the number of packets that conformed, exceeded, or violated the policer.
A step-by-step diagnostic flow: 1) Check global QoS state with `show mls qos`. 2) Verify trust settings on the ingress interface with `show mls qos interface <interface>`. 3) Check the applied policy map with `show policy-map interface <interface>`. 4) Examine queue statistics with `show mls qos interface <interface> statistics`. 5) Correlate with `show interfaces` for overall packet counts and errors. If the switch is dropping packets unexpectedly, check if the queue is congested by looking at the 'queue depth' and 'drop' counters. For example, if the priority queue is dropping packets, the queue might be too small or the policer is too restrictive.
Use `show mls qos ip` to see DSCP-based statistics. Additionally, `debug mls qos` can be used to trace packet marking and policing in real-time, but be cautious as it can be CPU-intensive. Always correlate with `show running-config | include mls qos` to ensure the configuration is correct.
A common mistake is applying a policy map to an interface without enabling `mls qos` globally; the policy will be accepted but not enforced. Another is misconfiguring the trust boundary, causing the switch to overwrite markings from trusted devices. By systematically checking these outputs, a network engineer can quickly isolate QoS-related problems.
CCNA Exam Tips
CCNA exam may ask which command enables QoS globally: 'mls qos' is required before any per-port QoS commands.
Know that 'mls qos trust cos' is used for ports connecting to IP phones that mark COS, while 'mls qos trust dscp' is for routers or hosts that mark DSCP.
The 'mls qos' command is not needed on routers; it is specific to Catalyst switches.
Remember that 'mls qos' must be configured before applying any QoS policy-map or class-map on a switch.
Common Mistakes
Forgetting to issue 'mls qos' globally before configuring per-port trust, resulting in 'trust' commands being rejected.
Applying 'mls qos trust dscp' on a port that receives only COS markings, causing incorrect classification.
Misconfiguring queue-set buffers and thresholds, leading to tail drop for critical traffic.
mls qos vs mls qos trust [cos|dscp]
These two commands are commonly confused because both relate to QoS marking handling on Cisco switches, yet they operate at different levels: one globally enables the QoS feature, while the other sets trust behavior on a per-interface basis. Without the global 'mls qos' command, the trust command has no effect.
| Aspect | mls qos | mls qos trust [cos|dscp] |
|---|---|---|
| Scope | Global (entire switch) | Interface-specific |
| Configuration mode | Global configuration | Interface configuration |
| Purpose | Enable QoS processing | Set trust state for QoS markings |
| Effect on markings | None directly; enables classification infrastructure | Causes switch to honor CoS or DSCP from incoming frames |
| Dependencies | Required before any trust or policy is active | Requires 'mls qos' globally to take effect |
| Persistence | Saved to running-config | Saved to running-config per interface |
Use 'mls qos' when you need to enable QoS on the switch as a prerequisite for any per-interface trust or policy configurations.
Use 'mls qos trust [cos|dscp]' on an interface when you want the switch to preserve and use the incoming CoS or DSCP marking for QoS classification.
Platform Notes
On Cisco IOS-XE platforms (e.g., Catalyst 3850, 9300), the `mls qos` command is still accepted for backward compatibility, but the recommended global QoS enable command is `qos` under the global configuration. For example, on IOS-XE, you would use `qos` to enable QoS globally. The syntax and behavior are identical.
On NX-OS (e.g., Nexus 9000), the equivalent command is `qos` under the global configuration, but the QoS model is different; NX-OS uses modular QoS CLI (MQC) and does not have the `mls qos` command. Instead, you enable QoS by configuring class maps and policy maps and applying them to interfaces; there is no global toggle. On ASA firewalls, QoS is enabled per interface using the `priority` command or `police` commands; there is no global QoS enable command.
On IOS-XR (e.g., ASR 9000), QoS is enabled by default and configured using policy maps; there is no equivalent to `mls qos`. In terms of IOS versions, `mls qos` has been available since IOS 12.x and remains in 15.x and 16.x. However, on newer hardware, the command may be deprecated in favor of the `qos` command.
Always check the specific platform documentation. For example, on Catalyst 2960-X running IOS 15.0, `mls qos` is still the primary command. On Catalyst 3650 running IOS-XE 16.x, both `mls qos` and `qos` work, but `qos` is preferred.
The output of `show mls qos` may vary slightly between IOS versions; for instance, older versions show 'QoS is enabled' while newer versions show 'Global QoS status: enabled'. When migrating from classic IOS to IOS-XE, be aware that the queueing configuration commands may differ (e.g., `mls qos srr-queue` vs `priority-queue`). Always verify the exact syntax for your platform.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions