SRX

Hello everyone,

 

My ISP requries me to set the 802.1p CoS bits to 001 on all out-going packets. That is all packets which I send from my SRX 220h (Junos 10.4) to the IPS's network must have this bit set.  No exception. 

 

I have played with re-write rules for the last two days but I can't get this to work. I can't imagine that to be very difficult. So I appreciate any help very much. 

 

Thanks in advance.

 

Hi

 

Im not completely sure if 802.1p marking is supported on SRX for L3 interfaces, but if it is, then the following set of commands should do the job

 

set class-of-service rewrite-rules ieee-802.1 class001 forwarding-class best-effort loss-priority high code-point 001
set class-of-service rewrite-rules ieee-802.1 class001 forwarding-class best-effort loss-priority medium-high code-point 001
set class-of-service rewrite-rules ieee-802.1 class001 forwarding-class best-effort loss-priority medium-low code-point 001
set class-of-service rewrite-rules ieee-802.1 class001 forwarding-class best-effort loss-priority low code-point 001
set class-of-service rewrite-rules ieee-802.1 class001 forwarding-class network-control loss-priority high code-point 001
set class-of-service rewrite-rules ieee-802.1 class001 forwarding-class network-control loss-priority medium-high code-point 001
set class-of-service rewrite-rules ieee-802.1 class001 forwarding-class network-control loss-priority medium-low code-point 001
set class-of-service rewrite-rules ieee-802.1 class001 forwarding-class network-control loss-priority low code-point 001
set class-of-service rewrite-rules ieee-802.1 class001 import default
set class-of-service interfaces ge-0/0/0 unit 0 rewrite-rules ieee-802.1 class001

 

Please notify me if this works,

Thanks for your support. I really appreciate it. Unfortunaltey, it's not working. I can't connect to my ISP and when I sniff the traffic, I can see that the p bit is still zero:

 

 

user@srx220# run monitor traffic interface ge-0/0/1 layer2-headers extensive 

 

Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.

Address resolution timeout is 4s.

Listening on ge-0/0/1, capture size 1514 bytes

15:40:20.723816 bpf_flags 0x80, Out 

   Juniper PCAP Flags [Ext], PCAP Extension(s) total length 22  

   Device Media Type Extension TLV #3, length 1, value: Ethernet (1)  

   Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)

   Device Interface Index Extension TLV #1, length 2, value: 34304  

   Logical Interface Index Extension TLV #4, length 4, value: 88  

   Logical Unit Number Extension TLV #5, length 4, value: 32767

-----original packet-----

Reverse lookup for 0.0.0.0 failed (check DNS reachability).

Other reverse lookup failures will not be reported.

Use <no-resolve> to avoid reverse lookups on IP addresses.

   78:19:f7:13:54:81 > Broadcast, ethertype 802.1Q (0x8100), length 346: vlan 1103, p 0, ethertype IPv4, (tos 0x0, ttl   1, id 23050, offset 0, flags [none], proto: UDP (17), length: 328) 0.0.0.0.bootpc > 255.255.255.255.bootps: [udp sum ok] BOOTP/DHCP, Request from 78:19:f7:13:54:81, length 300, xid 0x7bd3ee7b, Flags [Broadcast] (0x8000)  

 

  Client-Ethernet-Address 78:19:f7:13:54:81

  Vendor-rfc1048 Extensions    

  Magic Cookie 0x63825363    

  DHCP-Message Option 53, length 1: Discover

Can you post your interface and class of service config please. I will try to check it in my lab.

Hello,

 

thanks for your help. My interface config is rather simple:

 

user@srx220> show configuration interfaces ge-0/0/1   

 

description "M1 ISP (FTTH)";

vlan-tagging;

unit 1103 {   

   vlan-id 1103;   

   family inet {       

      dhcp;   

   }

}

 

 

The class of service conf is as follow:

 

user@srx220> show configuration class-of-service              

 

interfaces {   

   ge-0/0/1 {       

      unit 1103 {           

         rewrite-rules {               

            ieee-802.1 class001;           

         }       

      }   

   }

}

 

rewrite-rules {   

   ieee-802.1 class001 {       

      import default;       

      forwarding-class best-effort {           

         loss-priority high code-point 001;           

         loss-priority medium-high code-point 001;           

         loss-priority medium-low code-point 001;           

        loss-priority low code-point 001;       

      }       

     forwarding-class network-control {           

         loss-priority high code-point 001;           

         loss-priority medium-high code-point 001;           

         loss-priority medium-low code-point 001;           

         loss-priority low code-point 001;       

      }   

   }

}

 

 

Hi

 

I checked it in my lab and it turns out that 802.1p classification actually works. You cannot see it

in monitor traffic because (as I assume) in that output you see the traffic egressing RE which has not been

processed by CoS components yet.

 

However, on the connected device, I can check that both locally generated and transit packets

from the device on which 801.p rewrite-rule is applied are put in a separate queue for traffic having

801.p bits set to 001. So it seems that your setup is correct. You should ask your ISP what else

can be the problem.

 

The only thing I couldn't check is that particular DHCP packets, because SRX that I'm using as an analyzer

does not want to print layer2-headers in DHCP request for some reason, even when instructed to do so.

But I see no reason why these packets should not be remarked correctly.

Hello,

 

thanks for your help.

 

I have done the same here and plugged the SRX port ge-0/0/1 into a laptop running Wireshark to sniff the packets. With wireshark I can see that the 802.1p bits are all 0 and the re-write rules have no effect. I only have DHCP traffic in my test setup.

 

I am gravitating towards the idea that this is a bug in Junos. Which Junos version did you use? My SRX is running 10.4.

This is definitely a bug on the SRX with Junos 10.4.

 

I have placed a EX2200 switch (Junos 10.3) between the SRX and the service provider's ONT. On the EX2200 I have put two interfaces in trunk mode and configured the exact same 802.1p re-write rules that I have on the SRX. Only on the EX2200 they work.

 

If someone at Juniper reads this, please fix it. It's 100% reproducible. 

Hi all,

I have a similar question : marking with the same value all traffic going out from a particluar interface on my SRX550, so that QoS is handeled on transport network conencted to my SRX.

 

Somethong I don't understand in the config proposed above by PK :

 

The ieee-802.1 class includes the 2 forwarding-classes 'network-control' and 'best-effort'.
As the goal is to mark all packets, why don(t you plan statement for the 2 others forwarding-classes ?

 

admin@WALSF1# ...ewrite-rules ieee-802.1 test forwarding-class ?

Possible completions:
<class-name> Forwarding class name
assured-forwarding    <<------
best-effort
expedited-forwarding    <<------
network-control
[edit]
admin@WALSF1#

 

Thanks !
Fabien

Hi,
Time ago I had faced same problem but with dscp. I tried to configure 8 forwarding queues on srx210 and bfd from RE to be remarked on output. Or even added to particular forwarding queue. You should make enhancement request.

Did you ever have any luck with this? I'm facing the same issue.