Marking non voice traffic as EF in PA-220

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L3 Networker

Marking non voice traffic as EF in PA-220

I have a vpn tunnel & clients on the internal network need to initiate connections to a server on the other side (egress traffic).  The max upload speed of the broadband circuit is 5 megs which is always at max utilization.  Is there a way to mark traffic that is only best effort DSCP and change the value to EF 46 when crosses the Egress interface?  I set up a QoS profile using EF for all traffic to one destination but when I look at the captures the DSCP is still best effort/default.  I am trying to get this traffic to have the highest priority when going to the Egress interface.

 

Capture.PNG


Accepted Solutions
Highlighted
L7 Applicator

Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

 

Yep! It modifies it prior to egress:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKrCAK

View solution in original post


All Replies
Highlighted
L7 Applicator

There are a couple options:

 

1. If you want to set it on a specific type of traffic regardless of security rules, you can add a QoS policy for it to add the DSCP/ToS values.

Policies > QoS > Add > DSCP/ToS tab > Add.

Name: your choice

Type: EF

 

If you don't want just EF, you can select others or even write a custom value (in binary).

 

2. If you want to base it on specific security policies instead, you can open your security policy for this traffic and add a QoS marking:

Policies > Security > your_rule > Actions tab > Other Settings section > QoS Marking. Chose IP DSCP and a new drop-down appears.

EF should be there, and should be 101110 in binary.

Highlighted
L3 Networker

Thanks! Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?
Highlighted
L7 Applicator

Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

 

Yep! It modifies it prior to egress:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKrCAK

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!