Hi @aarseniev, many thanks for the detailed reply, it has cleared up a lot for me.
One final question you may be able to help with. Why is the default classifier on an access interface a ieee802.1p classifier (ieee 802.1untrust)? As we discussed this won't achieve anything.
Thanks in advance