Marking non voice traffic as EF in PA-220

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Marking non voice traffic as EF in PA-220

L3 Networker

I have a vpn tunnel & clients on the internal network need to initiate connections to a server on the other side (egress traffic).  The max upload speed of the broadband circuit is 5 megs which is always at max utilization.  Is there a way to mark traffic that is only best effort DSCP and change the value to EF 46 when crosses the Egress interface?  I set up a QoS profile using EF for all traffic to one destination but when I look at the captures the DSCP is still best effort/default.  I am trying to get this traffic to have the highest priority when going to the Egress interface.

 

Capture.PNG

1 accepted solution

Accepted Solutions

Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

 

Yep! It modifies it prior to egress:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKrCAK

View solution in original post

3 REPLIES 3

L7 Applicator

There are a couple options:

 

1. If you want to set it on a specific type of traffic regardless of security rules, you can add a QoS policy for it to add the DSCP/ToS values.

Policies > QoS > Add > DSCP/ToS tab > Add.

Name: your choice

Type: EF

 

If you don't want just EF, you can select others or even write a custom value (in binary).

 

2. If you want to base it on specific security policies instead, you can open your security policy for this traffic and add a QoS marking:

Policies > Security > your_rule > Actions tab > Other Settings section > QoS Marking. Chose IP DSCP and a new drop-down appears.

EF should be there, and should be 101110 in binary.

Thanks! Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

 

Yep! It modifies it prior to egress:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKrCAK

  • 1 accepted solution
  • 4284 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!