On Thu, Jan 23, 2014 at 2:41 AM, Alexandre Snarskii <[email protected]> wrote: > On Wed, Jan 22, 2014 at 09:20:36AM -0700, John Neiberger wrote: >> I ran into an issue yesterday that confused me, which seems to be a >> weekly occurrence lately regarding Juniper CoS.. We had an interface >> that was receiving traffic marked as EF. The interface only had the >> default CoS configuration. For some reason, the traffic was arriving >> at the destination marked as CS0. After I applied the CoS group to the >> interface, which included classifiers, the packets started arriving at >> the destination as EF like they were supposed to be. >> >> I don't understand why a lack of CoS config would reset DSCP markings >> for traffic that is already marked when it hits the router. Could it >> be that since there were no ingress classifiers, the traffic was not >> put into a forwarding class, so the rewrite rules on egress re-marked >> it? > > When there are no explicit classifiers configured for interface, there > are implicit "default ones" applied: > > [email protected]> show class-of-service interface ge-1/0/0.13 detail > Logical interface: ge-1/0/0.13, Index: 336 > Object Name Type Index > Classifier ipprec-compatibility ip 13 > > and yes, this classifier maps EF (DSCP 101110 = IPPREC 101) traffic > to BE forwarding class: > > [email protected]> show class-of-service classifier name ipprec-compatibility > Classifier: ipprec-compatibility, Code point type: inet-precedence, Index: 13 > Code point Forwarding class Loss priority > 000 best-effort low > 001 best-effort high > 010 best-effort low > 011 best-effort high > 100 best-effort low > 101 best-effort high > 110 network-control low > 111 network-control high > > so rewrite-rule configured on outbound interface will rewrite dscp/ipprec > to all-zeros (default for BE).
I have a follow-up to make sure I understand this. Let's say we have egress rewrite rules that look purely at forwarding class. If we have an ingress firewall filter on another interface that sets the forwarding class correctly, that will override the default classifiers on the ingress interface, right? I think it's starting to click. The classifier applied in the class-of-service config is a Behavior Aggregate classifer, but if we use a firewall filter for this purpose, it's called a multifield classifier, right? As long as one or the other is setting the forwarding class correctly, we're okay, but we run into problems if ingress traffic has DSCP markings already but doesn't match against a BA or MF classifier. In that case, the egress rewrite rules will re-mark the traffic unexpectedly. Do I finally have this straight in my head? lol Thanks, John _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
