QoS - Trust Boundaries

As we all know, we should perform traffic classification and marking as close to the network edge as possible (this means the access layer switches, or even devices connected to the access-layer).

Defining a trust boundary is important, it prevents unauthorised software/devices from marking packets with a priority that could be detrimental to other critical traffic flows.

There are three main trust boundaries at the access layer; host/IP phone/switch, this would generally be CoS markings, if you wish to mark at layer 3 (DSCP) then a distribution switch may be your trust boundary, as illustrated below.