7

I have performed some analysis and noticed that traffic coming in from the Internet contains a myriad of DSCP values. This traffic competes for voice and video resources on the internal network.

How do I establish a trust boundary where all incoming DSCP is rewritten to zero on Cisco and Juniper routers?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 9:38
5

The following policy-map would work. Just apply this to the inbound of the WAN interface.

policy-map MARKDOWN
  class class-default
    set dscp default

Interface Config:

interface gig 0/1
  service-policy input MARKDOWN

Just saw the bit about juniper. The following I believe will work for JunOS.

interfaces {
  so-1/2/3 {
    unit 0 {
      rewrite-rules {
        dscp default;
      }
    }
  }
}
  • 1
    On Cisco, I could also define a class to match not dscp default and set dscp default. I wonder if this results in processing efficiencies. – Dennis Olvany May 28 '13 at 21:34
  • 1
    Since marking is done in TCAM it shouldn't affect the speed in which it remarks. – bigmstone May 28 '13 at 21:39
  • Hmm, this seems to indicate that it may be a bit more involved than that on Juniper. – Dennis Olvany May 29 '13 at 3:12
0

I think I have this figured out on junos. I created a custom rewrite rule for every fc/plp combo in the implicit classifier map and applied it to the lan interfaces.

# show class-of-service
interfaces {
    ge-1/1/0 {
        unit 4 {
            rewrite-rules {
                dscp internet;
            }
        }
    }
    ge-1/1/1 {
        unit 4 {
            rewrite-rules {
                dscp internet;
            }
        }
    }
}
rewrite-rules {
    dscp internet {
        forwarding-class best-effort {
            loss-priority low code-point be;
            loss-priority high code-point be;
        }
        forwarding-class network-control {
            loss-priority high code-point be;
            loss-priority low code-point be;
        }
    }
}

[edit]
#

Edit: I came up with another method which only rewrites non-zero dscp. It requires applying a custom classifier to the wan interfaces and a custom rewrite rule to the lan interfaces.

# show
classifiers {
    dscp internet {
        forwarding-class best-effort {
            loss-priority low code-points 000000;
            loss-priority high code-points [ 000001 000010 000011 000100 000101 000110 000111 001000 001001 001010 001011 001100 001101 001110 001111 010000 010001 010010 010011 010100 010101 010110 010111 011000 011001 011010 011011 011100 011101 011110 011111 100000 100001 100010 100011 100100 100101 100110 100111 101000 101001 101010 101011 101100 101101 101110 101111 110000 110001 110010 110011 110100 110101 110110 110111 111000 111001 111010 111011 111100 111101 111110 111111 ];
        }
    }
}
interfaces {
    ge-1/1/0 {
        unit 0 {
            classifiers {
                dscp internet;
            }
        }
        unit 1 {
            classifiers {
                dscp internet;
            }
        }
        unit 3 {
            classifiers {
                dscp internet;
            }
        }
        unit 4 {
            rewrite-rules {
                dscp internet;
            }
        }
    }
    ge-1/1/1 {
        unit 3 {
            classifiers {
                dscp internet;
            }
        }
        unit 4 {
            rewrite-rules {
                dscp internet;
            }
        }
    }
}
rewrite-rules {
    dscp internet {
        forwarding-class best-effort {
            loss-priority high code-point be;
        }
    }
}

[edit class-of-service]
#
  • Once again, I am left wondering if there is an efficiency to be had. I could create a custom classifier map in order to rewrite only the dscp values which are non-zero. – Dennis Olvany May 29 '13 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.