DSCP Marking for BGP Keepalive Packet

Overview

Palo Alto Networks firewall is capable of setting the DSCP value to a BGP keepalive packet sent/exchanged with its BGP neighbor. The keepalive packet is initiated by the Palo Alt Networks firewall participating in BGP with other L3 devices.

The IP DSCP value can be selected under the Other Settings section of the Security Profile > Actions tab. The following example shows how Assured Forwarding 12(001100) for class1 is guaranteed:

A security policy must be configured to match the BGP traffic, and then set the DSCP information in the policy options. The BGP peering is established between 1.1.1.1 and 1.1.1.2 with 1.1.1.2 being the remote peer.

owner: kadak