Marking non voice traffic as EF in PA-220

[MarioMarquez]

I have a vpn tunnel & clients on the internal network need to initiate connections to a server on the other side (egress traffic).  The max upload speed of the broadband circuit is 5 megs which is always at max utilization.  Is there a way to mark traffic that is only best effort DSCP and change the value to EF 46 when crosses the Egress interface?  I set up a QoS profile using EF for all traffic to one destination but when I look at the captures the DSCP is still best effort/default.  I am trying to get this traffic to have the highest priority when going to the Egress interface.

[gwesson]

There are a couple options:

1. If you want to set it on a specific type of traffic regardless of security rules, you can add a QoS policy for it to add the DSCP/ToS values.

Policies > QoS > Add > DSCP/ToS tab > Add.

Name: your choice

Type: EF

If you don't want just EF, you can select others or even write a custom value (in binary).

2. If you want to base it on specific security policies instead, you can open your security policy for this traffic and add a QoS marking:

Policies > Security > your_rule > Actions tab > Other Settings section > QoS Marking. Chose IP DSCP and a new drop-down appears.

EF should be there, and should be 101110 in binary.

[MarioMarquez]

Thanks! Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

[gwesson · Accepted solution]

> Do these options actually change the DSCP value from best effort to EF? If I look in the header I should see EF afterwards without needing to change the DSCP on the internal client app machines is that correct?

Yep! It modifies it prior to egress:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKrCAK