Trust boundary

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

A trust boundary is a logical network boundary separating packet markings that a device accepts from markings it reclassifies.

A trust boundary is a logical network division that separates packet markings a device accepts from markings it reclassifies. Trusted markings pass through unchanged; untrusted markings are rewritten according to policy. A common boundary places IP phones on the trusted side and PCs on the untrusted side, preventing users from claiming preferential QoS treatment. section 10.3.4

Apply the boundary according to the device generating the marking:

• Trust IP phone markings, typically EF for actual voice audio, so the switch forwards them without modification. section 10.3.4
• Do not trust PC markings; re-mark packets from PCs to the appropriate value under the configured QoS policy. section 10.3.4
• Use the boundary to protect preferential treatment from inaccurate or deliberately manipulated QoS markings. section 10.3.4

Figure 10.16 Typical trust boundaries. IP phones mark their packets, and it is standard practice to trust them. Markings from PCs should usually not be trusted.

Visualizes the typical placement of a trust boundary between trusted IP phone markings and untrusted PC markings. section 10.3.4

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes

Defines trusted and untrusted behavior with a phone-versus-PC scenario, but does not provide CLI configuration or verification steps.

Examples

Contrasts EF-marked IP phone audio with PC traffic that must be re-marked.

What you can do after

Evaluate which device markings to trust and apply re-marking policy to untrusted traffic.

How it connects

Connects QoS marking, DSCP, IP phones, PCs, and re-marking policy.

liveBookmanning.com

Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

• threat modelused by · A threat model is a structured analysis or representation of a system’s relevant threats, adversaries, assets, attack paths, assumptions, and possible mitigations.
• foreign function interfaceequivalent to · A foreign function interface is a mechanism that enables code in one programming language to call functions or access data provided by another language through compatible conventions.
• layered policy architectureused by · A layered policy architecture organizes authorization rules into foundational, shared operational, and application-specific layers that are evaluated together.
• markingconfigures · Marking is the process of setting packet or traffic header fields to encode classification information for network policy enforcement.
• untrusted inputcontrasts with · Untrusted input is externally supplied data or content whose safety, integrity, or reliability has not been established for its processing context.

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.