Mailing List Archive: DSCP field not matched

DSCP field not matched

May 31, 2020, 12:43 PM

Post #1 of 4 (883 views)

Dear experts

I’ve two EX4300 (17.3R3-S3.3) connecting a WAN link and running macsec over
the WAN link, behind these EX4300 and on top to this link we’ve MX104
running MPLS traffic which pass through.

Since I’d like to run QoS on this WAN link, I see that EX4300 do not
matches dscp nor ip-precedence field.

Does anybody experience this kind of issue ?

Here the config of the fw filter applied in ingress:

set firewall family ethernet-switching filter QOS term PRIO from dscp cs4

set firewall family ethernet-switching filter QOS term PRIO then accept

set firewall family ethernet-switching filter QOS term PRIO then
forwarding-class prio

set firewall family ethernet-switching filter QOS term PRIO then count
COS-PRIO

set firewall family ethernet-switching filter QOS term VOICE from dscp ef

set firewall family ethernet-switching filter QOS term VOICE then accept

set firewall family ethernet-switching filter QOS term VOICE then
forwarding-class voice

set firewall family ethernet-switching filter QOS term VOICE then count
COS-VOICE

set firewall family ethernet-switching filter QOS term VIDEO from dscp af41

set firewall family ethernet-switching filter QOS term VIDEO from dscp af42

set firewall family ethernet-switching filter QOS term VIDEO from dscp af43

set firewall family ethernet-switching filter QOS term VIDEO then accept

set firewall family ethernet-switching filter QOS term VIDEO then
forwarding-class video

set firewall family ethernet-switching filter QOS term VIDEO then count
COS-VIDEO

set firewall family ethernet-switching filter QOS term NETWORK-CONTROL from
dscp cs6

set firewall family ethernet-switching filter QOS term NETWORK-CONTROL then
accept

set firewall family ethernet-switching filter QOS term NETWORK-CONTROL then
forwarding-class network-control

set firewall family ethernet-switching filter QOS term NETWORK-CONTROL then
count COS-NETWORK-CONTROL

set firewall family ethernet-switching filter QOS term LOW from dscp cs1

set firewall family ethernet-switching filter QOS term LOW from dscp af11

set firewall family ethernet-switching filter QOS term LOW from dscp af12

set firewall family ethernet-switching filter QOS term LOW from dscp af13

set firewall family ethernet-switching filter QOS term LOW then accept

set firewall family ethernet-switching filter QOS term LOW then
forwarding-class low

set firewall family ethernet-switching filter QOS term LOW then count
COS-LOW

set firewall family ethernet-switching filter QOS term BULK from dscp cs2

set firewall family ethernet-switching filter QOS term BULK from dscp af21

set firewall family ethernet-switching filter QOS term BULK from dscp af22

set firewall family ethernet-switching filter QOS term BULK from dscp af23

set firewall family ethernet-switching filter QOS term BULK then accept

set firewall family ethernet-switching filter QOS term BULK then
forwarding-class bulk

set firewall family ethernet-switching filter QOS term BULK then count
COS-BULK

set firewall family ethernet-switching filter QOS term BE then accept

set firewall family ethernet-switching filter QOS term BE then
forwarding-class best-effort

set firewall family ethernet-switching filter QOS term BE then count COS-BE

Here what is matching:

Name Bytes
Packets

COS-BE 635191150
2341894

COS-PRIO 0 0

COS-NETWORK-CONTROL 1970176
24149

COS-LOW 0 0

COS-BULK 0 0

COS-VIDEO
0 0

COS-VOICE 0
0

Basically only BE matches and Network control since on MX is running OSPF
and BGP (not family MPLS).

It seems EX4300 is not able to intercept family MPLS dscp field.

Any idea ?

Cheers

James
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp

Re: DSCP field not matched [ In reply to ]

saku at ytti

May 31, 2020, 11:22 PM

Post #2 of 4 (877 views)

Permalink

On Sun, 31 May 2020 at 22:51, james list <jameslist72@gmail.com> wrote:

> It seems EX4300 is not able to intercept family MPLS dscp field.
>
> Any idea ?

Pretty sure you need another device, like EX4650 with a flexible
filter or run 802.1Q for classification. You have implied ether-type
0x800 there, but even if you change it to 0x8847 it won't help you, as
you can't parse IP out of the MPLS nor can you match EXP/TC.
You also can't classify on EXP/TC under class-of-service classifier.

--
++ytti
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp

Re: DSCP field not matched [ In reply to ]

jameslist72 at gmail

Jun 1, 2020, 12:23 AM

Post #3 of 4 (877 views)

Permalink

Hi ytti
Can you share why EX4650 would do the job and EX4300 cannot? Do you have a
reference on juniper.com?

I am not sure what you mean with flexible filter, can you share an example?

Cheers
James

Il Lun 1 Giu 2020, 08:23 Saku Ytti <saku@ytti.fi> ha scritto:

> On Sun, 31 May 2020 at 22:51, james list <jameslist72@gmail.com> wrote:
>
> > It seems EX4300 is not able to intercept family MPLS dscp field.
> >
> > Any idea ?
>
> Pretty sure you need another device, like EX4650 with a flexible
> filter or run 802.1Q for classification. You have implied ether-type
> 0x800 there, but even if you change it to 0x8847 it won't help you, as
> you can't parse IP out of the MPLS nor can you match EXP/TC.
> You also can't classify on EXP/TC under class-of-service classifier.
>
> --
> ++ytti
>
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp

Re: DSCP field not matched [ In reply to ]

saku at ytti

Jun 1, 2020, 12:28 AM

Post #4 of 4 (877 views)

Permalink

On Mon, 1 Jun 2020 at 10:23, james list <jameslist72@gmail.com> wrote:

> Can you share why EX4650 would do the job and EX4300 cannot? Do you have a reference on juniper.com?

Flexible filter allows you to set a bit offset and a value, i.e. you
can match anything you want as long as it is in a predictable offset,
like in your case it is.

https://www.juniper.net/documentation/en_US/junos/topics/concept/firewall-filter-flexible-match-conditions-overview.html

I've previously used a flexible filter to verify if a UDP port is even
or odd, to mirror RTP signalling without mirroring RTP data to comply
with regulatorator while still having debuggability.

--
++ytti
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp