Thanks Jon. Actually we need this to work on the SRX210, SRX240, J4350 and M7i. We did find that we were able to add a input/output filter in order to classify on the sp- interface, but the SRX/J boxes don't allow application of a filter at all for the st0 interface it seems.
Thanks for the input in regards to the M-series, however; this will help us with the M7i for sure. From: Jonathan Looney [mailto:[email protected]] Sent: Tuesday, June 07, 2011 2:16 PM To: Devin Kennedy Cc: [email protected] Subject: Re: [j-nsp] Juniper Equivalent to Cisco's qos pre-classify? You didn't specify the platform. If you're speaking of something with an AS or MS card/module of some kind, then you can do this by classifying the pre-encrypted packet anytime between input and encryption. If you want to classify it on output to the encryption module, you would apply the classifier to the appropriate (inside) unit on the sp-* interface. I believe you can even apply a re-write rule on that interface that will change the original (unencrypted) packet's ToS bits as it transmitted to the AS/MS card/module for encryption. The ToS bits should get copied to the ESP (encrypted) packet's IP header, and I believe the router should maintain the previously-assigned forwarding class and loss priority for the packet. You'll just need to make sure you don't accidentally change the forwarding class/loss priority as the encrypted packet makes its way through the router a second time. Then, if desired, you can apply a custom rewrite rule on output. (Keep in mind that - if I recall correctly - the default IP precedence output rule may cause packets from other forwarding classes to be marked as best effort.) If you're speaking of an SRX device, then I can't help you definitively. However, I suspect it may work in a similar way if you substitute st interface for sp-* interface in the above. Hope that helps. -Jon On Tue, Jun 7, 2011 at 11:19 AM, Devin Kennedy <[email protected]> wrote: Hello: I'm trying to get our current CoS configurations to work with IPsec. I know that the ToS bits are copied to the IP header that ESP places on the encrypted payload. However, we are currently utilizing MF classifiers, so we are classifying based on dest/source addresses and ports. The problem is that the classification happens after encryption so all of our packets are being sent to the BE queue (since the TCP header is no longer visible after encryption). Is anyone aware of a command or a method of accomplishing the same thing as Cisco's "qos pre-classify" command so that the classification is done before the encryption process? Thanks for any help on this. Best Regards, Devin J Kennedy _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
