Article Detail

Description

Two examples:

Conforming-traffic is marked with a packet loss priority (PLP) of ‘low’ (CS3), respectively ‘medium-low’ (AF31) for the class ‘voice-signaling’ .

Non-conforming traffic (exceeding the policer thresholds) is marked with a PLP of ‘high’ , which makes it possible to treat this traffic differently from the conforming traffic (assigned with different DSCP value on the egress side using a rewrite-rule).

Symptoms

The behavior when configuring class of service (CoS) policing on an EX4300 is different compared to EX2200, EX3300, EX4200 and EX4550.

On an EX4300, when configuring a policer under the same firewall filter, together with actions ‘forwarding-class’ or ‘Loss-priority’ , the following commit error is occured:

 admin@EX4200# commit check 
 [edit firewall family ethernet-switching filter FILTER term VOICE_RTP_Traffic then loss-priority] 
 'loss-priority low' 
 Firewall and Policer Loss Priority conflicting 
 error: configuration check-out failed

Solution

Configuration on EX4300:

Define classifier:

set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class economy loss-priority low code-points be set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class economy-premarked loss-priority low code-points af11 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class economy-premarked loss-priority medium-high code-points af12 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class economy-premarked loss-priority high code-points af13 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class voice-signaling loss-priority low code-points cs3 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class voice-signaling loss-priority medium-high code-points af31 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class application loss-priority low code-points af21 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class application loss-priority medium-high code-points af22 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class application loss-priority high code-points af23 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class real-time loss-priority low code-points af41 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class real-time loss-priority medium-high code-points af42 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class real-time loss-priority high code-points af43 set class-of-service classifiers dscp ServerPolicy_TrustDSCP forwarding-class voice loss-priority low code-points ef

Define firewall filter:

set firewall family ethernet-switching filter UserPolicy_TrustDSCP term VOICE_RTP_Traffic from dscp ef set firewall family ethernet-switching filter UserPolicy_TrustDSCP term VOICE_RTP_Traffic then count EF_Traffic_counter set firewall family ethernet-switching filter UserPolicy_TrustDSCP term VOICE_RTP_Traffic then policer VOICE set firewall family ethernet-switching filter UserPolicy_TrustDSCP term VOICE_SIGNAL_CS3_Traffic from dscp cs3 set firewall family ethernet-switching filter UserPolicy_TrustDSCP term VOICE_SIGNAL_CS3_Traffic then policer VOICE set firewall family ethernet-switching filter UserPolicy_TrustDSCP term VOICE_SIGNAL_AF31_Traffic from dscp af31 set firewall family ethernet-switching filter UserPolicy_TrustDSCP term VOICE_SIGNAL_AF31_Traffic then policer VOICE set firewall family ethernet-switching filter UserPolicy_TrustDSCP term DEFAULT then forwarding-class economy set firewall family ethernet-switching filter UserPolicy_TrustDSCP term DEFAULT then loss-priority low

Policer configuration:

set firewall policer VOICE if-exceeding bandwidth-limit 1m set firewall policer VOICE if-exceeding burst-size-limit 16k set firewall policer VOICE then loss-priority high

Define rewrite rules:

set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class economy loss-priority low code-point be set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class economy-premarked loss-priority low code-point af11 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class economy-premarked loss-priority medium-high code-point af12 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class economy-premarked loss-priority high code-point af13 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class voice-signaling loss-priority low code-point cs3 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class voice-signaling loss-priority high code-point af11 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class voice-signaling loss-priority medium-high code-point af31 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class application loss-priority low code-point af21 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class application loss-priority medium-high code-point af22 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class application loss-priority high code-point af23 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class real-time loss-priority low code-point af41 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class real-time loss-priority medium-high code-point af42 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class real-time loss-priority high code-point af43 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class network-control loss-priority low code-point cs7 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class network-control loss-priority medium-high code-point cs6 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class telepresence loss-priority low code-point cs4 set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class voice loss-priority low code-point ef set class-of-service rewrite-rules dscp rewrite-dscp forwarding-class voice loss-priority high code-point af11 set class-of-service rewrite-rules ieee-802.1 rewrite-cos forwarding-class economy loss-priority low code-point 000 set class-of-service rewrite-rules ieee-802.1 rewrite-cos forwarding-class economy-premarked loss-priority low code-point 001 set class-of-service rewrite-rules ieee-802.1 rewrite-cos forwarding-class application loss-priority low code-point 010 set class-of-service rewrite-rules ieee-802.1 rewrite-cos forwarding-class voice-signaling loss-priority low code-point 011 set class-of-service rewrite-rules ieee-802.1 rewrite-cos forwarding-class real-time loss-priority low code-point 100 set class-of-service rewrite-rules ieee-802.1 rewrite-cos forwarding-class voice loss-priority low code-point 101

Apply scheduler on ingress interface:

set class-of-service interfaces ge-0/0/4 scheduler-map Ext-Port-Sched set class-of-service interfaces ge-0/0/4 unit * classifiers dscp ServerPolicy_TrustDSCP

Apply rewrite-rules on egress interface:

set class-of-service interfaces ge-0/0/6 scheduler-map Ext-Port-Sched set class-of-service interfaces ge-0/0/6 unit * classifiers dscp ServerPolicy_TrustDSCP set class-of-service interfaces ge-0/0/6 unit * rewrite-rules dscp rewrite-dscp

Send voice traffic marked with dscp ef:

root@EX4200# run show firewall

Filter: UserPolicy_TrustDSCP
Counters:
Name                               Bytes       Packets
EF_Traffic_counter                 131689500   87793
Policers:
Name                               Bytes       Packets
VOICE-VOICE_RTP_Traffic            130897500   87265
VOICE-VOICE_SIGNAL_AF31_Traffic    0           0
VOICE-VOICE_SIGNAL_CS3_Traffic     0           0


Filter: UserPolicy_TrustDSCP
Counters:
Name                               Bytes       Packets
EF_Traffic_counter                 152649000   101766 <--counter incrementing         
Policers:
Name                               Bytes       Packets
VOICE-VOICE_RTP_Traffic            151651500   101101
VOICE-VOICE_SIGNAL_AF31_Traffic    0           0
VOICE-VOICE_SIGNAL_CS3_Traffic     0           0


root@EX4300> show interfaces queue ge-0/0/6
Physical interface: ge-0/0/6, Enabled, Physical link is Up
Interface index: 701, SNMP ifIndex: 515
Forwarding classes: 16 supported, 12 in use
Egress queues: 12 supported, 12 in use
Queue: 0, Forwarding classes: economy
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 1, Forwarding classes: economy-premarked
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 2, Forwarding classes: voice-signaling
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 3, Forwarding classes: application
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 4, Forwarding classes: real-time
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 5, Forwarding classes: network-control
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 6, Forwarding classes: telepresence
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 7, Forwarding classes: voice
  Queued:
  Transmitted:
    Packets              :                     86521
    Bytes                :                     130127584
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 8, Forwarding classes: mcast-be
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 9, Forwarding classes: mcast-ef
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 10, Forwarding classes: mcast-af
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0
Queue: 11, Forwarding classes: mcast-nc
  Queued:
  Transmitted:
    Packets              :                     0
    Bytes                :                     0
    Tail-dropped packets :                     0
    RL-dropped packets   :                     0
    RL-dropped bytes     :                     0

root@EX4300> show interfaces ge-0/0/6 extensive | match pps
   Input  packets:                    264                  1 pps
   Output packets:                    1580718           8224 pps
     Input  packets:                    0                    0 pps
     Output packets:                    0                    0 pps

 On second EX4300 switch,connected to the first EX4300 
 
root@EX4300_2> show interfaces ge-0/0/6 extensive | match pps
   Input  packets:                    1408565837        8225 pps
   Output packets:                    198643               1 pps
     Input  packets:                    0                    0 pps
     Output packets:                    0                    0 pps

Traffic captured on the second EX4300 to check if packets are remarked:

root@:RE:0% tcpdump -nnvvXs 9000 -i ge-0/0/6 Address resolution is OFF. Listening on ge-0/0/6, capture size 9000 bytes  15:04:44.391695 In Juniper PCAP Flags [Ext, no-L2, In], PCAP Extension(s) total length 22 Device Media Type Extension TLV #3, length 1, value: Ethernet (1) Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14) Device Interface Index Extension TLV #1, length 2, value: 35330 Logical Interface Index Extension TLV #4, length 4, value: 553 Logical Unit Number Extension TLV #5, length 4, value: 10 -----original packet----- IP (tos 0x28, ttl 64, id 0, offset 0, flags [none], proto: ICMP (1), length: 1482) 11.11.11.3 > 11.11.11.5: ICMP echo request, id 0, seq 0, length 1462 0x0000 0000 0002 4528 05ca 0000 0000 4001 48ee ....E([email protected]. 0x0010 0b0b 0b03 0b0b 0b05 0800 df12 0000 0000 ................ 0x0020 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f ................ 0x0030 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................
0x0040 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./
0x0050 3031 3233 3435 3637 3839 3a3b 3c3d 3e3f 0123456789:

As shown in the output above:

IP (tos 0x28).TOS is in hexadecimal.

TOS=0x28 => 28 in hexa => 00101000

Since DSCP code point alias is only on 6 bits, we remove the last 2 "0" bits => 001010 which matches AF11.