topic Re: Drop DSCP marked traffic in General Topics

Drop DSCP marked traffic

mcg12-arl — Wed, 22 Feb 2012 20:06:23 GMT

Hi, I am looking for a way to define a DSCP value as a condition for a rule. I would like to drop traffic that was previously marked before entering the PAN FW.

Any ideas?

Thanks!

Re: Drop DSCP marked traffic

rmonvon — Fri, 24 Feb 2012 04:57:57 GMT

Hi...We cannot define security rule to match on the DSCP marking/value. We can override the DSCP value and set it to another value by matching on the application, traffic, etc.

Maybe you can describe what you're trying to enforce?

Re: Drop DSCP marked traffic

mcg12-arl — Fri, 24 Feb 2012 13:59:29 GMT

Thanks for the reply

I am marking specific traffic elswhere on the network that I would like to block outbound before reaching the Internet acces point. I was hopping to use PAN to block this marked traffic, with additional higher priority exception rules for OS updates/AV updates/etc.

I guess that you have confirmed what I was able to find in the config, so I will address this through other means

Thanks

Re: Drop DSCP marked traffic

rmonvon — Fri, 24 Feb 2012 19:38:31 GMT

Since this marked traffic will reach the PA device anyway, may I suggest we let the PA device ID the traffic. The traffic may match one of our 1500 apps and you can simply define a policy to block the app/traffic.

Thanks.