mls qos...

enabling mls qos globally...

dls1#config t
Enter configuration commands, one per line.  End with CNTL/Z.
dls1(config)#mls qos
QoS: ensure flow-control on all interfaces are OFF for proper operation.
dls1(config)#do sho mls qos
QoS is enabled
dls1(config)#end
dls1#sh mls qos int f0/15
FastEthernet0/15
trust state: not trusted
trust mode: not trusted
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: none

dls1#

note by default the trust state is untrusted, therefore QoS markings sent by a connected device are untrusted... in other words, the receiving switch will re-mark all inbound frames to a CoS value of 0

a trust boundary is the line in the sand whereby a switch will not trust incoming QoS labels, ie, between itself and a connected pc.  however,  voice phones should be trusted, whereas the pc connected to the phone will not be trusted

the ip phone is seen as another switch, therefore trusted...

below, i've put mls qos trust cos, then in the next statement i added device cisco-phone... the trust state is not trusted because no phone is attached...

dls1(config-if)#mls qos trust dev cisco-phone
dls1(config-if)#do sh mls qos int f0/15      
FastEthernet0/15
trust state: not trusted
trust mode: trust cos
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: cisco-phone

but now i connect the phone...

dls1(config-if)#do sh mls qos int f0/15
FastEthernet0/15
trust state: trust cos
trust mode: trust cos
COS override: dis
default COS: 0
DSCP Mutation Map: Default DSCP Mutation Map
Trust device: cisco-phone


and the state moves to trusted...