mls qos trust [cos|dscp]
Sets the trust state on an interface to use either the CoS or DSCP value for QoS classification, enabling the switch to honor incoming QoS markings.
Definition: mls qos trust [cos|dscp] is a Cisco IOS interface config command. Sets the trust state on an interface to use either the CoS or DSCP value for QoS classification, enabling the switch to honor incoming QoS markings.
Overview
The `mls qos trust [cos|dscp]` command is a fundamental QoS configuration command on Cisco Catalyst switches that enables the switch to honor incoming Layer 2 CoS (Class of Service) or Layer 3 DSCP (Differentiated Services Code Point) markings. In a typical enterprise network, QoS markings are applied at the edge (e.g., IP phones, access switches) to classify traffic into different service classes. Without trust, the switch would re-mark all incoming traffic to a default CoS or DSCP value, effectively discarding any prior classification.
This command is critical for preserving end-to-end QoS policies, especially in voice and video deployments where consistent treatment across the network is required. The concept of trust is central to QoS: a trusted interface accepts the markings from the connected device, while an untrusted interface overwrites them. Network engineers reach for this command when connecting IP phones, video endpoints, or other QoS-aware devices that mark their own traffic.
It is often used in conjunction with `mls qos` (global enable) and `mls qos trust device` for Cisco IP phones. The command operates at the interface level and is typically applied on access ports facing endpoints or trunk ports connecting to other trusted switches. In the broader configuration workflow, trust is set before defining service policies or queueing strategies.
Important IOS behaviors: the command requires `mls qos` to be enabled globally; otherwise, it has no effect. The trust state is stored in the running configuration and can be verified with `show mls qos interface`. On some platforms, trust can also be set per VLAN or per port.
The command does not buffer output; it takes effect immediately. Privilege level 15 (enable) is required. A common pitfall is forgetting to enable `mls qos` globally, which causes the trust command to be accepted but ignored.
Another is trusting DSCP on a Layer 2-only switch that does not examine Layer 3 headers, leading to no effect. Understanding trust is essential for CCNA and CCNP candidates because it underpins QoS classification and marking, which are key topics in the exam blueprints.
mls qos trust [cos|dscp]When to Use This Command
- Trusting DSCP markings from a VoIP phone to prioritize voice traffic on an access port.
- Trusting CoS markings from a router on a trunk link to preserve QoS across the network.
- Configuring trust on an uplink port to a service provider to accept their DSCP markings.
- Setting trust on a port connected to a trusted server that marks its own traffic.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| cos | cos | Sets the trust state to use the incoming CoS (Class of Service) value for QoS classification. CoS is a 3-bit field in the 802.1Q VLAN tag, ranging from 0 to 7. This parameter is typically used on access ports connecting to IP phones or other devices that mark CoS. Common mistake: using this on a trunk port where CoS is already preserved; it may cause double-tagging issues. |
| dscp | dscp | Sets the trust state to use the incoming DSCP (Differentiated Services Code Point) value for QoS classification. DSCP is a 6-bit field in the IP header, ranging from 0 to 63. This parameter is used on interfaces facing routers or other Layer 3 devices that mark DSCP. Common mistake: applying this on a Layer 2-only switch that cannot inspect IP headers, resulting in no effect. |
Command Examples
Trust DSCP on an access port for VoIP
interface GigabitEthernet0/1
mls qos trust dscpSwitch(config-if)# mls qos trust dscp Switch(config-if)# end Switch# show mls qos interface GigabitEthernet0/1 GigabitEthernet0/1 trust state: trust dscp trust mode: trust dscp COS override: dis default COS: 0 DSCP mutation: none trust device: none qos mode: port-based
The 'trust state' shows the current trust setting. 'trust dscp' means the switch will use the DSCP value for QoS. 'COS override' is disabled, so CoS is not used. 'default COS' is 0 for untrusted traffic. 'DSCP mutation' is none, meaning no DSCP mapping is applied. 'trust device' shows no specific device trust. 'qos mode' is port-based.
Trust CoS on a trunk port
interface GigabitEthernet0/2
mls qos trust cosSwitch(config-if)# mls qos trust cos Switch(config-if)# end Switch# show mls qos interface GigabitEthernet0/2 GigabitEthernet0/2 trust state: trust cos trust mode: trust cos COS override: dis default COS: 0 DSCP mutation: none trust device: none qos mode: port-based
The 'trust state' is now 'trust cos', meaning the switch will use the CoS value from the frame. All other fields remain similar. This is typical on trunk links where CoS markings are preserved.
Understanding the Output
The 'show mls qos interface' command displays the QoS trust configuration for a specific interface. The 'trust state' field indicates whether the interface trusts CoS, DSCP, or is untrusted. 'trust mode' shows the configured trust type.
'COS override' indicates if CoS is overridden (dis or en). 'default COS' is the CoS value assigned to untrusted traffic. 'DSCP mutation' shows any DSCP mutation map applied.
'trust device' indicates if a specific device (like Cisco IP Phone) is trusted. 'qos mode' shows the QoS mode (port-based or vlan-based). A good configuration shows the desired trust state; a bad configuration might show 'untrusted' when trust was intended.
Configuration Scenarios
Trust CoS on an Access Port for an IP Phone
An IP phone is connected to a switch port. The phone marks its voice traffic with CoS 5 and signaling with CoS 3. The switch must trust these markings to apply appropriate QoS policies downstream.
Topology
IP Phone --- (Gi0/1) Switch1 (Gi0/2) --- RouterSteps
- 1.Step 1: Enter global configuration mode: Switch1> enable
- 2.Step 2: Enter global configuration mode: Switch1# configure terminal
- 3.Step 3: Enable QoS globally: Switch1(config)# mls qos
- 4.Step 4: Enter interface configuration mode for the port connected to the IP phone: Switch1(config)# interface gigabitethernet0/1
- 5.Step 5: Set the port to trust CoS: Switch1(config-if)# mls qos trust cos
- 6.Step 6: Optionally, configure the phone as a Cisco IP phone for CDP-based trust: Switch1(config-if)# mls qos trust device cisco-phone
- 7.Step 7: Exit and save configuration: Switch1(config-if)# end; Switch1# copy running-config startup-config
! mls qos ! interface GigabitEthernet0/1 mls qos trust cos mls qos trust device cisco-phone !
Verify: Use 'show mls qos interface gigabitethernet0/1' to verify trust state. Expected output includes 'trust state: trust cos' and 'trust device: cisco-phone'.
Watch out: If the IP phone is not a Cisco device, the 'mls qos trust device cisco-phone' command may not work; use only 'mls qos trust cos'.
Trust DSCP on a Trunk Port Between Switches
Two switches are connected via a trunk. The upstream switch marks traffic with DSCP values. The downstream switch must trust these DSCP markings to maintain consistent QoS across the network.
Topology
Switch1 (Gi0/24) --- trunk --- (Gi0/24) Switch2Steps
- 1.Step 1: Enable QoS globally on both switches: Switch1(config)# mls qos; Switch2(config)# mls qos
- 2.Step 2: On Switch2, enter interface configuration for the trunk port: Switch2(config)# interface gigabitethernet0/24
- 3.Step 3: Set the port to trust DSCP: Switch2(config-if)# mls qos trust dscp
- 4.Step 4: Ensure the port is configured as a trunk: Switch2(config-if)# switchport mode trunk
- 5.Step 5: Exit and save: Switch2(config-if)# end; Switch2# copy running-config startup-config
! mls qos ! interface GigabitEthernet0/24 switchport mode trunk mls qos trust dscp !
Verify: Use 'show mls qos interface gigabitethernet0/24' to verify. Expected output: 'trust state: trust dscp'. Also check 'show mls qos' to confirm global QoS is enabled.
Watch out: If the trunk port carries multiple VLANs, ensure that the upstream switch is also configured to trust DSCP; otherwise, markings may be overwritten at the source.
Troubleshooting with This Command
When troubleshooting QoS trust issues, the first step is to verify that `mls qos` is enabled globally using `show mls qos`. If not enabled, trust commands are ignored. Next, check the interface trust state with `show mls qos interface [interface-id]`.
Healthy output shows 'trust state: trust cos' or 'trust state: trust dscp' as configured. Problem indicators include 'trust state: not trusted' or 'trust state: untrusted', which means the switch is overwriting markings. Another common issue is 'trust state: trust cos' but the traffic is IP-based; in that case, the switch will use CoS even if DSCP is marked, potentially causing misclassification.
Focus on the 'trust state' field and the 'trust device' field if applicable. If voice traffic is not receiving priority, check that the IP phone is actually marking CoS 5; use `show mls qos interface [interface-id] statistics` to see the number of packets received with each CoS or DSCP value. A step-by-step diagnostic flow: 1) Verify global QoS enable. 2) Verify interface trust state. 3) Check if the device is sending marked packets (e.g., use a packet capture or `show mls qos interface [interface-id] statistics`). 4) If trust is set but no effect, ensure the platform supports the trust type (e.g., some switches cannot trust DSCP on access ports). 5) Correlate with `show mls qos maps` to see how CoS/DSCP are mapped to internal queues.
Common symptoms: voice traffic dropped or delayed – often due to untrusted port or incorrect trust type. Another symptom: all traffic treated equally – indicates trust not set or global QoS disabled. Use `debug mls qos` cautiously in a lab to see real-time trust decisions.
Correlate with `show policy-map interface` if service policies are applied. Remember that trust is only one part of QoS; classification and marking must be consistent end-to-end.
CCNA Exam Tips
Remember that 'mls qos trust' must be configured after enabling 'mls qos' globally.
On access ports, trust DSCP is common for VoIP; on trunk ports, trust CoS is typical.
The default trust state on a port is 'untrusted' unless explicitly configured.
CCNA may test that 'mls qos trust cos' is used on trunk ports to preserve Layer 2 CoS markings.
Common Mistakes
Forgetting to enable 'mls qos' globally before configuring trust on an interface.
Using 'mls qos trust cos' on an access port where DSCP is more appropriate for IP traffic.
Assuming trust is enabled by default; it is not, and QoS markings will be ignored without it.
mls qos trust [cos|dscp] vs mls qos
The commands 'mls qos trust [cos|dscp]' and 'mls qos' are often considered together because QoS trust decisions are applied per-interface, but the entire QoS feature must be enabled globally first. Without the global 'mls qos', the interface trust command is ineffective.
| Aspect | mls qos trust [cos|dscp] | mls qos |
|---|---|---|
| Scope | Per-interface | Global (entire switch) |
| Configuration Mode | Interface configuration mode | Global configuration mode |
| Function | Sets trust state (CoS or DSCP) on an interface | Enables QoS globally; enters MLS QoS config mode |
| Prerequisite | Requires 'mls qos' globally enabled | None (the initial command) |
| Effect on traffic | Honors incoming CoS/DSCP markings on that interface | Permits configuration of trust, queueing, policing |
Use mls qos trust [cos|dscp] when you need a specific interface to preserve and use the incoming CoS or DSCP markings for QoS classification.
Use mls qos when you need to enable QoS globally on the switch as a prerequisite for any per-interface trust or other QoS features.
Platform Notes
On IOS-XE (e.g., Catalyst 3650/3850/9300), the command syntax is identical: `mls qos trust [cos|dscp]`. However, the verification output differs slightly; use `show mls qos interface [interface-id]` but also `show platform qos` for detailed statistics. On NX-OS (e.g., Nexus 9000), the equivalent command is `qos trust [cos|dscp]` under interface configuration, and global QoS is enabled by default.
For example: `interface ethernet1/1; qos trust cos`. On ASA firewalls, trust is not directly configured; instead, service policies with `set dscp` or `set cos` are used. On IOS-XR (e.g., ASR 9000), the command does not exist; QoS trust is configured via policy maps with `class-map` and `policy-map` using `set dscp` or `set cos`.
Differences between IOS versions: In 12.x, `mls qos trust` may require `mls qos` global enable, but in 15.x and 16.x, the behavior is consistent. Some older switches (e.g., Catalyst 2950) only support CoS trust. Always check platform documentation for specific trust capabilities.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions