Now in networking devices, specifically with quality of service, we have the concept of trust and
a trust boundary.
Who are you going to trust?
So as an example, if a switch receives a data packet from a PC, is it going to trust the markings
if the PC is telling the switch that its traffic is very important?
Typically a switch will not trust a PC, but a switch may trust the markings from a phone.
An IP phone, as an example, will tell a switch by using a marking that its traffic is very important.
A switch needs to be configured to trust that marking from the phone.
So we have this concept of a trust boundary and untrusted domain is the part of the network that you
are not managing.
So it could be a PC, it could be a printer.
You're not going to trust the marking sent by a user's PC from a quality of service point of view.
The trusted domain is the part of the network that only administrators can manage, so they are trusted
devices such as routers and switches and in some cases IP phones.
A router is going to trust the markings that it receives from a switch, and a switch is going to trust
the markings that it receives from an IP phone.
Now, the trust boundary is where packets are classified and marked.
So as an example, the IP phones are a trust boundary.
We don't trust the markings to the left of the IP phones, but we do trust the marking sent between
phones, switches and routers.
So in an enterprise, any markings received by any of these devices will be trusted.
A service provider or ISP, however, may not trust the marking sent on packets from customers.
So this would be a separate trust boundary.
The ISP will trust any markings of packets in its own domain or in its own network, but may not trust
the markings sent to it by a enterprise customer.
In an enterprise network, the trust boundary is typically the edge of the network.
For an ISP, the trust boundary is typically found at the lost device that it manages.
So as an example, if the ISP provides you a router that it manages, the trust boundary is set there
and it will trust any markings of devices that it controls, but not markings received from devices
that it doesn't control.
Trust boundaries are important because by default, Cisco routers will override any quality of service
markings that they receive on an untrusted boundary.
So voice traffic and video traffic and data traffic will be treated as the same if you don't remark
that traffic.
In other words, if a rider receives traffic on an untrusted interface, it will treat it the same,
which can have a negative effect on quality of service.