Beginning with Junos 14.2R3, there is a packet marking scheme, called policy map, that allows the definition of rewrite rules on a per-customer basis. Policy maps are defined at the [edit class-of-service policy-map] hierarchy level and can be assigned to a customer through a firewall action, an ingress interface, or a routing policy. A policy map is executed on a packet just before it is queued, so it overrides any other packet marking scheme that was previously applied to the packet.

This article provides a configuration example.

Traditionally, packet marking in Junos uses the forwarding class and loss priority determined from a BA classifier or multifield classifier. This approach does not allow for direct assignment of rewrite rules on a per-customer basis due to the limited number of combinations of forwarding class and loss priority. However, packet marking with policy map allows rewrite rules on a per-customer basis.

The Junos 14.2 Release Notes refers to the following new feature:

• Support for packet marking schemes on a per-customer basis (MX Series)

Assigning Rewrite Rules on a Per-Customer Basis Using Policy Maps Overview

• INET-Precedence with the following options:
  • proto-ip – Mark the packet for IPv4 to IPv4 traffic
  • proto-mpls – Mark the packet for an IPv4 packet entering an MPLS tunnel
• IPv4 DSCP with the following options:
  • proto-ip – Mark the packet for IPv4 to IPv4 traffic
  • proto-mpls – Mark the packet for an IPv4 packet entering an MPLS tunnel
• IPv6 DSCP with the following options:
  • proto-ip – Mark the packet for IPv6 to IPv6 traffic
  • proto-mpls – Mark the packet for an IPv4 packet entering an MPLS tunnel
• MPLS EXP with the following options:
  • all-label – Mark all labels
  • outer-label – Mark only the outer label
• IEEE 802.1p with the following options:
  • outer – Mark only the outer VLAN header
  • outer-and-inner – Mark both the outer and inner VLAN headers
• IEEE 802.1ad with the following options:
  • outer – Mark only the outer VLAN header
  • outer-and-inner – Mark both the outer and inner VLAN headers

• Creating a policy map requires enhanced-ip, enhanced-ethernet, or enhanced-mode to be configured under [edit chassis network-services].
• Policy maps have the following configuration restrictions:
  • When configuring both proto-ip and proto-mpls options for inet-precedence,dscp, or dscp-ipv6, you must configure both options with the same code point or code point alias.
  • You cannot configure inet-precedence and dscp in the same policy map.
  • In case of MPLS SWAP/PUSH operation, only the new labels are marked on all LSRs, except the penultimate hop case where if it exposes the next label in the stack then the exposed label is marked. Therefore with thepenultimate hop, the service label is changed.
  • You cannot configure ieee-802.1 and ieee-802.1ad in the same policy map.
  • You cannot configure both outer and outer-and-inner options for ieee-802.1 and ieee-802.1ad code points in the same policy map.
  • For IEEE 802.1ad with the outer-and-inner option, the DE Bit is marked only for the outer VLAN header. For the inner VLAN header, only the 3 CoS Bits are marked.

Configuring Policy Maps to Assign Rewrite Rules on a Per-Customer Basis

• MX Series routers containing MPCs
• Junos OS Release 14.2R3 or later

1. Configure a policy map.
   
   [edit class-of-service policy-map policy-map-name]
user@host# set inet-precedence proto-ip code-point [alias | bits];
user@host# set inet-precedence proto-mpls code-point [alias | bits]
user@host# set dscp proto-ip code-point [alias | bits]
user@host# set dscp proto-mpls code-point [alias | bits]
user@host# set dscp-ipv6 proto-ip code-point [alias | bits]
user@host# set dscp-ipv6 proto-mpls code-point [alias | bits]
user@host# set exp all-label code-point [alias | bits]
user@host# set exp outer-label code-point [alias | bits]
user@host# set ieee-802.1 outer code-point [alias | bits]
user@host# set ieee-802.1 outer-and-inner code-point [alias | bits]
user@host# set ieee-802.1ad outer code-point [alias | bits]
user@host# set ieee-802.1ad outer-and-inner code-point [alias | bits]

• Apply the policy map to an ingress or egress firewall filter
  
  [edit firewall family protocol-family-name filter filter-name]
user@host# set term term-name from match-conditions
user@host# set term term-name then policy-map policy-map-name
  
  For example:
  [edit firewall family inet filter f1]
user@host# set term t1 from address 10.2.2.0/24
user@host# set term t1 then policy-map p1

• Alternatively, apply the policy map to a routing instance.
  
  [edit class-of-service]
user@host# set routing-instances routing-instance-name policy-map policy-map-name
  
  For example:
  [edit class-of-service]
user@host# set routing-instances r1 policy-map p1

• Alternatively, apply the policy map directly to an ingress interface.
  
  [edit class-of-service]
user@host# set interfaces interface-name unit logical-unit-number policy-map
policy-map-name
  
  For example:
  [edit class-of-service]
user@host# set interfaces xe-4/0/0 unit 0 policy-map p1

Sample Output