1

I'm doing a lab because I need to mark traffic with 802.1p tag to apply QoS on my ISP layer 2 uplink. I've managed to classify my network traffic and did applyed DSCP marking on the packets but I can't manage to do the same for 802.1p marking.

I want to mark traffic :

  • to 10.143.0.126 with DSCP EF and 802.1p 5
  • to 10.143.0.132 with DSCP CS4 and 802.1p 4
  • to everything else no marking

This is an SRX320 in version 21.4R3.15, here is the conf :

set interfaces ge-0/0/0 unit 0 description LAN
set interfaces ge-0/0/0 unit 0 family inet address 10.12.251.254/24
set interfaces ge-0/0/5 unit 0 description UPL
set interfaces ge-0/0/5 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members 667
set interfaces irb unit 667 family inet filter output QOS
set interfaces irb unit 667 family inet address 172.31.150.78/30
set class-of-service interfaces irb unit 667 rewrite-rules dscp QOS
set class-of-service interfaces irb unit 667 rewrite-rules ieee-802.1 QOS
set class-of-service rewrite-rules dscp QOS forwarding-class assured-forwarding loss-priority medium-low code-point cs4
set class-of-service rewrite-rules dscp QOS forwarding-class expedited-forwarding loss-priority low code-point ef
set class-of-service rewrite-rules ieee-802.1 QOS forwarding-class assured-forwarding loss-priority medium-low code-point 100
set class-of-service rewrite-rules ieee-802.1 QOS forwarding-class expedited-forwarding loss-priority low code-point 101
set firewall family inet filter QOS term VOIX from destination-address 10.143.0.126/32
set firewall family inet filter QOS term VOIX then count VOIX
set firewall family inet filter QOS term VOIX then loss-priority low
set firewall family inet filter QOS term VOIX then forwarding-class expedited-forwarding
set firewall family inet filter QOS term PROD from destination-address 10.143.0.132/32
set firewall family inet filter QOS term PROD then count PROD
set firewall family inet filter QOS term PROD then loss-priority medium-low
set firewall family inet filter QOS term PROD then forwarding-class assured-forwarding
set firewall family inet filter QOS term INTERNET then count INTERNET
set firewall family inet filter QOS term INTERNET then loss-priority high
set firewall family inet filter QOS term INTERNET then forwarding-class best-effort
set firewall family inet filter QOS term INTERNET then accept
set vlans COL vlan-id 667
set vlans COL l3-interface irb.667
set protocols l2-learning global-mode switching
set routing-options static route 0.0.0.0/0 next-hop 172.31.150.77

as you can see in those wireshark captures, DSCP is applied accordingly but the 802.1p tag is still 0 : enter image description here

enter image description here

Improve this question
5
  • "to everything else no marking" There is always a marking. I think you mean BE (0). The layer-2 marking only works on trunk links, and remember that marking traffic for the public Internet does nothing because it will be ignored by the Internet providers. QoS is great for your internal network, but there is no QoS on the public Internet.
    – Ron Maupin ♦
    Commented Jun 12 at 13:45
  • By saying no marking I'm of course refering to default marking which is 0. This traffic isn't going to Internet, it's going to a layer 2 collective LAN of my provider which is limited in bandwith and deliverd at my central site. When this link is congested, I need my Voice traffic to be prioritised, thing that my provider can do if the packet is marked with 802.1p tag.
    – ichigo vingt-neuf
    Commented Jun 12 at 15:28
  • The layer-2 QoS is not in regular ethernet frame headers, only in those with VLAN tags on trunk links.
    – Ron Maupin ♦
    Commented Jun 12 at 15:54
  • Thank you for your help. I'm applying the 802.1 rewrite rule on my irb.667 interface, this is a vlan interface, should it not work ? What should I change in my config for it to work ?
    – ichigo vingt-neuf
    Commented Jun 13 at 8:20
  • Interfaces can be in a VLAN without tagging the frames. That is how most switch interfaces are when devices are attached to them. You only tag on trunks that carry multiple VLANs as a way to separate the frames into the various VLANs. A regular ethernet frame header has no place for the VLAN number, priority, or QoS information. When sent across a trunk link with other VLANs, tags that contain that information are inserted into the frame header. Most end-devices do not understand VLAN tags, so access interfaces do not include them, only trunk interfaces where the device does understand them.
    – Ron Maupin ♦
    Commented Jun 13 at 13:05

1 Answer 1

Reset to default
1

Just found the solution. The interface I was using is IRB which is declared as a layer 3 Interface.

As Ron was saying, because the interface is layer 3 interface, no layer 2 802.1p tag is available to rewrite.

I used a vlan tagging interface instead and It Worked.

I now can tag on layer 3 DSCP and layer 2 802.1p depending on a filter I set which can use source / destination address or port.

Configuration :

set security policies from-zone EXT to-zone TRUST policy P1 match source-address any
set security policies from-zone EXT to-zone TRUST policy P1 match destination-address any
set security policies from-zone EXT to-zone TRUST policy P1 match application any
set security policies from-zone EXT to-zone TRUST policy P1 then permit
set security policies from-zone EXT to-zone TRUST policy P1 then count
set security policies from-zone TRUST to-zone EXT policy P2 match source-address any
set security policies from-zone TRUST to-zone EXT policy P2 match destination-address any
set security policies from-zone TRUST to-zone EXT policy P2 match application any
set security policies from-zone TRUST to-zone EXT policy P2 then permit
set security policies from-zone TRUST to-zone EXT policy P2 then count
set security policies from-zone TRUST to-zone TRUST policy P3 match source-address any
set security policies from-zone TRUST to-zone TRUST policy P3 match destination-address any
set security policies from-zone TRUST to-zone TRUST policy P3 match application any
set security policies from-zone TRUST to-zone TRUST policy P3 then permit
set security policies from-zone TRUST to-zone TRUST policy P3 then count
set security zones security-zone TRUST interfaces ge-0/0/0.0 host-inbound-traffic system-services ping
set security zones security-zone TRUST interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh
set security zones security-zone EXT interfaces ge-0/0/5.667 host-inbound-traffic system-services ping
set security zones security-zone EXT interfaces ge-0/0/5.667 host-inbound-traffic system-services ssh
set interfaces ge-0/0/0 unit 0 description LAN
set interfaces ge-0/0/0 unit 0 family inet address 10.12.251.254/24
set interfaces ge-0/0/5 vlan-tagging
set interfaces ge-0/0/5 unit 667 description UPL
set interfaces ge-0/0/5 unit 667 vlan-id 667
set interfaces ge-0/0/5 unit 667 family inet filter output QOS
set interfaces ge-0/0/5 unit 667 family inet address 172.31.150.78/30
set class-of-service interfaces ge-0/0/5 unit 667 rewrite-rules dscp QOS
set class-of-service interfaces ge-0/0/5 unit 667 rewrite-rules ieee-802.1 QOS
set class-of-service rewrite-rules dscp QOS forwarding-class assured-forwarding loss-priority medium-low code-point cs4
set class-of-service rewrite-rules dscp QOS forwarding-class expedited-forwarding loss-priority low code-point ef
set class-of-service rewrite-rules ieee-802.1 QOS forwarding-class assured-forwarding loss-priority medium-low code-point 100
set class-of-service rewrite-rules ieee-802.1 QOS forwarding-class expedited-forwarding loss-priority low code-point 101
set firewall filter QOS term VOIX from destination-address 10.143.0.126/32
set firewall filter QOS term VOIX then count VOIX
set firewall filter QOS term VOIX then loss-priority low
set firewall filter QOS term VOIX then forwarding-class expedited-forwarding
set firewall filter QOS term PROD from destination-address 10.143.0.132/32
set firewall filter QOS term PROD then count PROD
set firewall filter QOS term PROD then loss-priority medium-low
set firewall filter QOS term PROD then forwarding-class assured-forwarding
set firewall filter QOS term INTERNET then count INTERNET
set firewall filter QOS term INTERNET then loss-priority high
set firewall filter QOS term INTERNET then forwarding-class best-effort
set firewall filter QOS term INTERNET then accept
set vlans COL vlan-id 667
set protocols l2-learning global-mode switching
set protocols rstp interface all
set routing-options static route 0.0.0.0/0 next-hop 172.31.150.77
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.