Chapter 8: Quality of Service, Multicast Snooping, and DHCP Services

Ethernet is best-effort by default. When a 1 Gb uplink fills up, every flow suffers equally - bulk traffic just slows, but a voice call drops words. QoS is the policy machinery that lets the switch say "voice goes first, video next, file copies last" when the pipe is congested.

QoS only matters at points of contention. The classic campus contention point is the access-to-aggregation uplink, where many 1 Gb edge ports converge onto a smaller number of 10/25 Gb uplinks.

The four-stage QoS pipeline

1. Classify - class-map: identify the traffic (DSCP, CoS, or ACL).
2. Mark/queue - policy-map: set DSCP/CoS, assign to internal queue.
3. Schedule - schedule-profile: who serves first (strict vs DWRR).
4. Shape/drop - queue-profile: per-queue rate limits and WRED.

Trust modes

The first decision a packet faces: do I trust the markings the sender wrote?

The default of trust none is a common gotcha. A new Aruba CX deployment with IP phones will not honor DSCP 46 markings until you set qos trust dscp on the access port. Without trust, voice rides the default queue alongside YouTube.

DSCP / CoS to queue mapping

Scheduling - strict vs DWRR

• Strict priority - queue is always served first while it has packets. Cap with shaping or it will starve other queues.
• DWRR (Deficit Weighted Round Robin) - queues served in proportion to weights when congested.

schedule-profile S-PROFILE
   queue 7 strict
   queue 6 dwrr weight 50
   queue 5 dwrr weight 40
   queue 0 dwrr weight 10

Canonical edge recipe

class-map match-any CLASS_VOICE
   match dscp 46
class-map match-any CLASS_VIDEO
   match dscp 34

policy-map EDGE-IN
   class CLASS_VOICE
      queue 7
   class CLASS_VIDEO
      queue 6

interface 1/1/10
   description "IP phone + PC daisy chain"
   qos trust dscp
   service-policy input EDGE-IN

Layer 2 switches treat multicast like broadcast - flood every port in the VLAN. A single 50 Mb video multicast that one host subscribes to floods every other host on the VLAN. IGMP snooping is the fix: the switch listens to IGMP Membership Reports, Leaves, and Queries, and dynamically forwards each multicast group only to subscribed ports plus the multicast router port.

IGMP versions and querier

Every snooping VLAN needs a querier - a device that periodically sends IGMP General Queries so that hosts respond with Membership Reports. In a routed multicast network, the PIM router is automatic. In a flat L2 network, you must enable a snooping querier on the SVI.

Enabling IGMP snooping

IGMP snooping is disabled by default. Default version when enabled is v3.

# Global - simplest
switch(config)# ip igmp snooping all-vlans

# Per-VLAN
switch(config)# vlan 10
switch(config-vlan-10)# ip igmp snooping enable
switch(config-vlan-10)# ip igmp snooping version 2   # only if v2 hosts present

Snooping querier on the SVI

switch(config)# interface vlan 10
switch(config-if-vlan)# ip address 10.10.10.1/24
switch(config-if-vlan)# ip igmp snooping querier

If two queriers exist, IGMP elects the lowest IP as active.

Static mrouter port

switch(config)# vlan 10
switch(config-vlan-10)# ip igmp snooping mrouter interface 1/1/24

Verification commands

DHCP comes in two flavors on a campus switch:

• DHCP relay - lets clients reach a DHCP server on a different subnet. Without it, DHCPDISCOVER broadcasts die at the SVI.
• DHCP snooping - security feature that blocks rogue DHCP servers and builds the binding database for DAI/IPSG.

Both can - and usually should - coexist on the same access switch.

DHCP relay - ip helper-address

Routers do not forward broadcasts. The SVI catches the DHCPDISCOVER and relays it as a unicast to the server, setting the giaddr field so the server picks the right scope.

switch(config)# interface vlan 10
switch(config-if-vlan)# ip address 10.10.10.1/24
switch(config-if-vlan)# ip helper-address 10.50.50.10
switch(config-if-vlan)# ip helper-address 10.50.50.11   # redundancy

DHCP snooping - blocking rogue servers

All ports are untrusted by default. On an untrusted port, the switch:

• Permits client-side messages (DISCOVER, REQUEST, RELEASE, DECLINE).
• Drops server-side messages (OFFER, ACK, NAK) - this blocks rogue servers.
• Builds binding-database entries as it sees client leases.

switch(config)# dhcpv4-snooping
switch(config)# vlan 10
switch(config-vlan-10)# dhcpv4-snooping
switch(config)# interface 1/1/24
switch(config-if)# description "Uplink to DHCP server"
switch(config-if)# dhcpv4-snooping trust

Forgetting trust on the uplink is a common mistake - clients then fail to get addresses because the legitimate OFFER is dropped along with the rogue ones.

The binding database

This binding database is the foundation for both Dynamic ARP Inspection and IP Source Guard.

Option 82

Relay or snooping switches can insert Option 82 (Relay Agent Information) so the upstream server can identify the originating port/switch. Useful for assigning IPs from specific scopes per port, logging which port leased an address, or rejecting requests without expected relay info.

Once the DHCP snooping binding database exists, two more security features can use it as their truth source. Add loop protect and storm control and you have a five-feature L2 hardening stack that should be standard on every access port.

Dynamic ARP Inspection (DAI)

DAI inspects every ARP on untrusted ports and verifies the sender's IP/MAC/port against the snooping binding DB. If it doesn't match, drop. DAI requires DHCP snooping - without the binding DB it has nothing to validate against.

switch(config)# vlan 10
switch(config-vlan-10)# arp inspection

switch(config)# interface 1/1/24
switch(config-if)# arp inspection trust

Static-IP gotcha: in a server VLAN with statically addressed servers, DAI black-holes them unless you add manual ip source-binding entries. This is the single biggest deployment mistake.

IP Source Guard / IP Source Lockdown

IPSG filters IP traffic on access ports against the binding table. Only traffic whose {MAC, IP, VLAN, port} tuple matches a binding is forwarded. Like DAI, depends on DHCP snooping; breaks for static-IP hosts without manual bindings.

switch(config)# ip source-binding 00:11:22:33:44:55 vlan 10 ipv4 10.10.10.50 interface 1/1/5

Loop protect

STP can miss inadvertently bridged ports (a user looping a patch cable into a wall jack, a rogue mini-switch). Loop protect transmits a loop-detect frame and shuts the port if it returns.

switch(config)# loop-protect
switch(config)# interface 1/1/1-1/1/24
switch(config-if-<>)# loop-protect

Apply on every access port; do not apply on uplinks (managed by STP/MSTP).

Storm control

Rate-limits broadcast / multicast / unknown-unicast frames per port. Use cases: a NIC stuck in broadcast, a worm fan-out, ARP flood.

switch(config)# interface 1/1/1
switch(config-if)# storm-control broadcast level pps 100
switch(config-if)# storm-control multicast level pps 200
switch(config-if)# storm-control unknown-unicast level pps 100