topic Marking non voice traffic as EF in PA-220 in General Topics

Marking non voice traffic as EF in PA-220

MarioMarquez — Thu, 25 Apr 2019 20:12:17 GMT

I have a vpn tunnel & clients on the internal network need to initiate connections to a server on the other side (egress traffic). The max upload speed of the broadband circuit is 5 megs which is always at max utilization. Is there a way to mark traffic that is only best effort DSCP and change the value to EF 46 when crosses the Egress interface? I set up a QoS profile using EF for all traffic to one destination but when I look at the captures the DSCP is still best effort/default. I am trying to get this traffic to have the highest priority when going to the Egress interface.

Re: Marking non voice traffic as EF in PA-220

gwesson — Thu, 25 Apr 2019 22:43:40 GMT

There are a couple options:

1. If you want to set it on a specific type of traffic regardless of security rules, you can add a QoS policy for it to add the DSCP/ToS values.

Policies > QoS > Add > DSCP/ToS tab > Add.

Name: your choice

Type: EF

If you don't want just EF, you can select others or even write a custom value (in binary).

2. If you want to base it on specific security policies instead, you can open your security policy for this traffic and add a QoS marking:

Policies > Security > your_rule > Actions tab > Other Settings section > QoS Marking. Chose IP DSCP and a new drop-down appears.

EF should be there, and should be 101110 in binary.

Re: Marking non voice traffic as EF in PA-220

MarioMarquez — Fri, 26 Apr 2019 01:58:00 GMT

Thanks! Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

Re: Marking non voice traffic as EF in PA-220

gwesson — Fri, 26 Apr 2019 17:20:32 GMT

> Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

Yep! It modifies it prior to egress:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKrCAK