QoS Markings

[jsanchez]

I have a couple pa-500's. I have a voip system that right now sits in front of the FW. I would like to put it behind the FW. If I have my switches and routers currently marking the voip traffic with an ip precedence of 5. Once I move the VOIP systme behind FW will the marking be acknowledge by the PA's? Is it as simple as creating a QoS policy and specifying the tag that maps it to a specific class?

[mikand]

If im not mistaken PA can tag the traffic being sent (for switches and routers to pickup) along with prioritize on the egress interface.

Not sure if it will listen to incoming tags or not (I think you must manually setup what you wish to QoS through your PA device).

In your case if you set your VOIP server on its own interface you wont need to setup any QoS in your PA since the VOIP server will be the only device on this interface (since QoS acts on traffic thats about to leave the PA).

[jsanchez]

Yeah, I know the PA can tag the traffic. Really trying to find out if it will acknowledge the tags placed by other devices. All my tagging gets done by MPLS routers so that VOIP traffic has priority over anything else going on.

I think I will give the VOIP system explicit class 1 priority based on ip without tagging it on the PA's and allow the routers to tag it before it enters the MPLS cloud. I just hope there isn't much latency added in the process.

I really can't use an interface just for the VOIP system, since I have none free .

Thanks!

[sjamaluddin]

If you know the IP address of the sources you may use them in the QOS policy to identify /mark the traffic to place the traffic into a particular class, instead of using the already tagged DSCP values. The PAN Firewall, as you can see in the QOS policy, will not be able to read anything other than the criteria / conditions there. Already tagged packets will not be read appropriately, but you can identify and classify this VoIP traffic using the options available in the QoS policy defination.