Routing

This message was posted by a user wishing to remain anonymous

Hello,

I have a requirement to mark the traffic that my router sent to the customer with a DSCP marker (AF31).

I am not very familiar with DSCP marking on Juniper and I need some help from someone who has experience with QoS (DSCP marking) on Juniper.

The topology is: Server <-> Router1 <-MPLS-> Juniper MX <-eBGP-> Customer

I read the documentation related to DSCP marking / QoS and I implemented the below config on the MX router. Unfortunately, it is not working as expected.

set interfaces x unit y family inet filter output DSCP_IPv4

set firewall family inet filter DSCP_marking term 1 then dscp af31
set firewall family inet filter DSCP_marking term last then accept

After the implementation I noticed that Juniper MX marks the traffic on both directions (inbound and outbound), even if the marking is applied only for the outbound traffic.
Juniper MX should mark only the traffic sent to Customer. The traffic received from Customer is not marked and it should be sent to Router1 and Server without any marking.

But, somehow the traffic received from Customer is marked by Juniper MX and sent to the internal network with AF31.

My questions are:
1. Is the config wrong? Have I missed anything?

2. Can I use this family filter for IPv6 traffic, as well? Should I change anything for IPv6? From my understanding, I can use for IPv6, as well. In order to be on the safe side, I would like to double check with someone who has experience with DSCP markers on MX.

Any help is much appreciated! Thank you!

This message was posted by a user wishing to remain anonymous

Hello,

In the initial post I paste the wrong config. Here is the config used:
set interfaces x unit y family inet filter output DSCP_marking

set firewall family inet filter DSCP_marking term 1 then dscp af31
set firewall family inet filter DSCP_marking term last then accept
Original Message:
Sent: 11-02-2022 10:10
From: Anonymous User
Subject: DSCP marker Juniper MX

This message was posted by a user wishing to remain anonymous

Hello,

I have a requirement to mark the traffic that my router sent to the customer with a DSCP marker (AF31).

I am not very familiar with DSCP marking on Juniper and I need some help from someone who has experience with QoS (DSCP marking) on Juniper.

The topology is: Server <-> Router1 <-MPLS-> Juniper MX <-eBGP-> Customer

I read the documentation related to DSCP marking / QoS and I implemented the below config on the MX router. Unfortunately, it is not working as expected.

set interfaces x unit y family inet filter output DSCP_IPv4

set firewall family inet filter DSCP_marking term 1 then dscp af31
set firewall family inet filter DSCP_marking term last then accept

After the implementation I noticed that Juniper MX marks the traffic on both directions (inbound and outbound), even if the marking is applied only for the outbound traffic.
Juniper MX should mark only the traffic sent to Customer. The traffic received from Customer is not marked and it should be sent to Router1 and Server without any marking.

But, somehow the traffic received from Customer is marked by Juniper MX and sent to the internal network with AF31.

My questions are:
1. Is the config wrong? Have I missed anything?

2. Can I use this family filter for IPv6 traffic, as well? Should I change anything for IPv6? From my understanding, I can use for IPv6, as well. In order to be on the safe side, I would like to double check with someone who has experience with DSCP markers on MX.

Any help is much appreciated! Thank you!

Hi,

1. Is the config wrong? Have I missed anything?
The config should work. Is it possible to share the actual configuration of both the ingress and egress interfaces?
Also, how was it verified that the traffic from the customer side is not marked?  One way to check this would be to apply this filter on the customer-facing MX interface and verify if the af31 counter values increment. If they do, then the traffic received from the customer is already marked.

Also, apply and check the same filter on the internal interface (egress direction), to verify if the packets leaving the MX routers are marked, even if they were received unmarked from the customer end.

family inet {
    filter DSCP_check {
        term 1 {
            from {
                dscp af31;
            }
            then {
                count af31;
                accept;
            }
        }
        term last {
            then accept;
        }
    }
}


 show firewall filter DSCP_check 

Filter: DSCP_check                                             
Counters:
Name                                                Bytes              Packets
af31                                                    0                    0
​

2. Can I use this family filter for IPv6 traffic, as well? Should I change anything for IPv6? From my understanding, I can use for IPv6, as well. In order to be on the safe side, I would like to double check with someone who has experience with DSCP markers on MX.
Use family inet6 filter.

------------------------------
Sheetanshu Shekhar
------------------------------

Original Message:
Sent: 11-02-2022 10:10
From: Anonymous User
Subject: DSCP marker Juniper MX

This message was posted by a user wishing to remain anonymous

Hello,

I have a requirement to mark the traffic that my router sent to the customer with a DSCP marker (AF31).

I am not very familiar with DSCP marking on Juniper and I need some help from someone who has experience with QoS (DSCP marking) on Juniper.

The topology is: Server <-> Router1 <-MPLS-> Juniper MX <-eBGP-> Customer

I read the documentation related to DSCP marking / QoS and I implemented the below config on the MX router. Unfortunately, it is not working as expected.

set interfaces x unit y family inet filter output DSCP_IPv4

set firewall family inet filter DSCP_marking term 1 then dscp af31
set firewall family inet filter DSCP_marking term last then accept

After the implementation I noticed that Juniper MX marks the traffic on both directions (inbound and outbound), even if the marking is applied only for the outbound traffic.
Juniper MX should mark only the traffic sent to Customer. The traffic received from Customer is not marked and it should be sent to Router1 and Server without any marking.

But, somehow the traffic received from Customer is marked by Juniper MX and sent to the internal network with AF31.

My questions are:
1. Is the config wrong? Have I missed anything?

2. Can I use this family filter for IPv6 traffic, as well? Should I change anything for IPv6? From my understanding, I can use for IPv6, as well. In order to be on the safe side, I would like to double check with someone who has experience with DSCP markers on MX.

Any help is much appreciated! Thank you!

This message was posted by a user wishing to remain anonymous

Hello,

Thank you for your feedback!

On the customer side there is no qos/dscp marking. We performed tests and the traffic is sent by him without any marking.

We performed packet captures on all the nodes: customer, Juniper MX, Router1. The conclusions are:
- the traffic generated by the server reaches Juniper MX, where the traffic is marked properly. Customer receives the traffic from MX with AF31.
- customer send the traffic without any marking, it reaches Juniper MX, where the traffic is marked and I don`t understand why. The traffic sent by MX is received by Router1 with AF31.

Original Message:
Sent: 11-03-2022 02:27
From: Sheetanshu Shekhar
Subject: DSCP marker Juniper MX

Hi,

1. Is the config wrong? Have I missed anything?
The config should work. Is it possible to share the actual configuration of both the ingress and egress interfaces?
Also, how was it verified that the traffic from the customer side is not marked?  One way to check this would be to apply this filter on the customer-facing MX interface and verify if the af31 counter values increment. If they do, then the traffic received from the customer is already marked.

Also, apply and check the same filter on the internal interface (egress direction), to verify if the packets leaving the MX routers are marked, even if they were received unmarked from the customer end.

family inet {    filter DSCP_check {        term 1 {            from {                dscp af31;            }            then {                count af31;                accept;            }        }        term last {            then accept;        }    }} show firewall filter DSCP_check Filter: DSCP_check                                             Counters:Name                                                Bytes              Packetsaf31                                                    0                    0​

2. Can I use this family filter for IPv6 traffic, as well? Should I change anything for IPv6? From my understanding, I can use for IPv6, as well. In order to be on the safe side, I would like to double check with someone who has experience with DSCP markers on MX.
Use family inet6 filter.

------------------------------
Sheetanshu Shekhar

Original Message:
Sent: 11-02-2022 10:10
From: Anonymous User
Subject: DSCP marker Juniper MX

This message was posted by a user wishing to remain anonymous

Hello,

I have a requirement to mark the traffic that my router sent to the customer with a DSCP marker (AF31).

I am not very familiar with DSCP marking on Juniper and I need some help from someone who has experience with QoS (DSCP marking) on Juniper.

The topology is: Server <-> Router1 <-MPLS-> Juniper MX <-eBGP-> Customer

I read the documentation related to DSCP marking / QoS and I implemented the below config on the MX router. Unfortunately, it is not working as expected.

set interfaces x unit y family inet filter output DSCP_IPv4

set firewall family inet filter DSCP_marking term 1 then dscp af31
set firewall family inet filter DSCP_marking term last then accept

After the implementation I noticed that Juniper MX marks the traffic on both directions (inbound and outbound), even if the marking is applied only for the outbound traffic.
Juniper MX should mark only the traffic sent to Customer. The traffic received from Customer is not marked and it should be sent to Router1 and Server without any marking.

But, somehow the traffic received from Customer is marked by Juniper MX and sent to the internal network with AF31.

My questions are:
1. Is the config wrong? Have I missed anything?

2. Can I use this family filter for IPv6 traffic, as well? Should I change anything for IPv6? From my understanding, I can use for IPv6, as well. In order to be on the safe side, I would like to double check with someone who has experience with DSCP markers on MX.

Any help is much appreciated! Thank you!

Hi,

Thanks for the confirmation.

- Is it possible to share the interface configuration (both the interfaces)?
- Is it possible to share the output of "show class-of-service" from the Juniper MX? There may be a rewrite rule configured.

Regards
Sheetanshu

------------------------------
Sheetanshu Shekhar
------------------------------

Original Message:
Sent: 11-03-2022 10:45
From: Anonymous User
Subject: DSCP marker Juniper MX

This message was posted by a user wishing to remain anonymous

Hello,

Thank you for your feedback!

On the customer side there is no qos/dscp marking. We performed tests and the traffic is sent by him without any marking.

We performed packet captures on all the nodes: customer, Juniper MX, Router1. The conclusions are:
- the traffic generated by the server reaches Juniper MX, where the traffic is marked properly. Customer receives the traffic from MX with AF31.
- customer send the traffic without any marking, it reaches Juniper MX, where the traffic is marked and I don`t understand why. The traffic sent by MX is received by Router1 with AF31.

Original Message:
Sent: 11-03-2022 02:27
From: Sheetanshu Shekhar
Subject: DSCP marker Juniper MX

Hi,

1. Is the config wrong? Have I missed anything?
The config should work. Is it possible to share the actual configuration of both the ingress and egress interfaces?
Also, how was it verified that the traffic from the customer side is not marked?  One way to check this would be to apply this filter on the customer-facing MX interface and verify if the af31 counter values increment. If they do, then the traffic received from the customer is already marked.

Also, apply and check the same filter on the internal interface (egress direction), to verify if the packets leaving the MX routers are marked, even if they were received unmarked from the customer end.

family inet {    filter DSCP_check {        term 1 {            from {                dscp af31;            }            then {                count af31;                accept;            }        }        term last {            then accept;        }    }} show firewall filter DSCP_check Filter: DSCP_check                                             Counters:Name                                                Bytes              Packetsaf31                                                    0                    0​

2. Can I use this family filter for IPv6 traffic, as well? Should I change anything for IPv6? From my understanding, I can use for IPv6, as well. In order to be on the safe side, I would like to double check with someone who has experience with DSCP markers on MX.
Use family inet6 filter.

------------------------------
Sheetanshu Shekhar

Original Message:
Sent: 11-02-2022 10:10
From: Anonymous User
Subject: DSCP marker Juniper MX

This message was posted by a user wishing to remain anonymous

Hello,

I have a requirement to mark the traffic that my router sent to the customer with a DSCP marker (AF31).

I am not very familiar with DSCP marking on Juniper and I need some help from someone who has experience with QoS (DSCP marking) on Juniper.

The topology is: Server <-> Router1 <-MPLS-> Juniper MX <-eBGP-> Customer

I read the documentation related to DSCP marking / QoS and I implemented the below config on the MX router. Unfortunately, it is not working as expected.

set interfaces x unit y family inet filter output DSCP_IPv4

set firewall family inet filter DSCP_marking term 1 then dscp af31
set firewall family inet filter DSCP_marking term last then accept

After the implementation I noticed that Juniper MX marks the traffic on both directions (inbound and outbound), even if the marking is applied only for the outbound traffic.
Juniper MX should mark only the traffic sent to Customer. The traffic received from Customer is not marked and it should be sent to Router1 and Server without any marking.

But, somehow the traffic received from Customer is marked by Juniper MX and sent to the internal network with AF31.

My questions are:
1. Is the config wrong? Have I missed anything?

2. Can I use this family filter for IPv6 traffic, as well? Should I change anything for IPv6? From my understanding, I can use for IPv6, as well. In order to be on the safe side, I would like to double check with someone who has experience with DSCP markers on MX.

Any help is much appreciated! Thank you!