Understanding CoS Support on st0 Interfaces

The st0 tunnel interface is an internal interface that can be used by route-based VPNs to route cleartext traffics to an IPsec VPN tunnel. The following CoS features are supported on the st0 interface on all available SRX Series devices and vSRX2.0:

• Classifiers

• Policers

• Queuing, scheduling, and shaping

• Rewrite markers

• Virtual channels

Limitations of CoS support on VPN st0 interfaces

• The maximum number for software queues is 2048. If the number of st0 interfaces exceeds 2048, not enough software queues can be created for all the st0 interfaces.

• Only route-based VPNs can apply CoS features on st0 interfaces. Table 1 describes the st0 CoS feature support for different types of VPNs.

  Table 1: CoS Feature Support for VPN

  Classifier Features	Site-to-Site VPN (P2P)	AutoVPN (P2P)	Site-to-Site/Auto VPN /AD-VPN (P2MP)
  Classifiers, policers, and rewriting markers	Supported	Supported	Supported
  Queueing, scheduling, and shaping based on st0 logical interfaces	Supported	Not supported	Not supported
  Queueing, scheduling, and shaping based on virtual channels	Supported	Supported	Supported

• On SRX300, SRX320, SRX340, SRX345, and SRX550HM devices, one st0 logical interface can bind to multiple VPN tunnels. The eight queues for the st0 logical interface cannot reroute the traffic to different tunnels, so pre-tunneling is not supported.

  Note

  The virtual channel feature can be used as a workaround on SRX300, SRX320, SRX340, SRX345, and SRX550HM devices.

• When defining a CoS shaping rate on an st0 tunnel interface, consider the following restrictions:

  • The shaping rate on the tunnel interface must be less than that of the physical egress interface.

  • The shaping rate only measures the packet size that includes the inner Layer 3 cleartext packet with an ESP/AH header and an outer IP header encapsulation. The outer Layer 2 encapsulation added by the physical interface is not factored into the shaping rate measurement.

  • The CoS behavior works as expected when the physical interface carries the shaped GRE or IP-IP tunnel traffic only. If the physical interface carries other traffic, thereby lowering the available bandwidth for tunnel interface traffic, the CoS features do not work as expected.

• On SRX550M, SRX5400, SRX5600, and SRX5800 devices, bandwidth limit and burst size limit values in a policer configuration are a per-SPU, not per-system limitation. This is the same policer behavior as on the physical interface.