I'm still learning how Junos handles DSCP marking and I ran into a question based on something I saw in production.
Let's assume we have an irb, and in that irb is an ae, and the ae has two physical ports in it. If I want to mark traffic on ingress, does it matter on which interfaces I configure the marking filter and rewrite rules? My guess is that if you only apply them to a single interface, only traffic on that interface will be marked. If you apply it to the ae then all interfaces in that ae bundle will be marked, but other interfaces in the irb wouldn't be marked. If you apply it on the irb then everything goes through the marking filter. Is that about right? This is on an MX960. Are there some nuances on this platform that might affect the decision on where to apply these filters and rules? The odd thing on the interface I'm looking at is that the irb has the ingress marking firewall filter but it does not have the rewrite rules associated with it. Instead, the ae interface has the rewrite rules associated with it. So, on ingress, a frame travels through an ae interface with rewrite rules added to it, but no filter to specify any markings. That doesn't happen until the frame hits the irb, which doesn't have rewrite rules applied. I'm a little confused about why this is working. I would have expected to see the rewrite rules applied to the same L3 interface that has the ingress firewall filter applied. Thanks, John _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
