[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring DSCP in an IDP Policy

Configuring Differentiated Services Code Point (DSCP) values in IDP policies provides a method of associating class-of-service (CoS) values—thus different levels of reliability—for different types of traffic on the network.

Before You Begin
For background information, read: Class of Service chapters in the JUNOS Software Interfaces and Routing Configuration Guide. IDP Policies Overview Establish basic connectivity. For more information, see the Getting Started Guide for your device. Configure network interfaces. See the JUNOS Software Interfaces and Routing Configuration Guide. Enable IDP application services in a security policy. See Enabling IDP in a Security Policy. Create security zones. See Creating Security Zones. Define rules. See Defining Rules for an IPS Rulebase.

Before You Begin

For background information, read:
- Class of Service chapters in the JUNOS Software Interfaces and Routing Configuration Guide.
- IDP Policies Overview
Establish basic connectivity. For more information, see the Getting Started Guide for your device.
Configure network interfaces. See the JUNOS Software Interfaces and Routing Configuration Guide.
Enable IDP application services in a security policy. See Enabling IDP in a Security Policy.
Create security zones. See Creating Security Zones.
Define rules. See Defining Rules for an IPS Rulebase.

DSCP is an integer value encoded in the 6-bit field defined in IP packet headers. It is used to enforce CoS distinctions. CoS allows you to override the default packet forwarding behavior and assign service levels to specific traffic flows.

You can configure DSCP value as an action in an IDP policy rule. You first define the traffic by defining match conditions in the IDP policy and then associate a DiffServ marking action with it. Based on the DSCP value, behavior aggregate classifiers set the forwarding class and loss priority for the traffic deciding the forwarding treatment the traffic receives.

All packets that match the IDP policy rule have the CoS field in their IP header rewritten with the DSCP value specified in the matching policy. If the traffic matches multiple rules with differing DSCP values, the first IDP rule that matches takes effect and this IDP rule then applies to all traffic for that session.

The configuration instructions in this topic describe how to create a policy called policy1, specify a rulebase for this policy, and then add a rule R1 to this rulebase. In this example, rule R1:

Specifies the match condition to include any traffic from a previously configured zone called zone1 to another previously configured zone called zone2. The match condition also includes a predefined attack group called Critical - HTTP. The application setting in the match condition is specified as default and matches any application configured in the attack object.
Specifies an action to rewrite the CoS field in the IP header with the DSCP value 50 for any traffic that matches the criteria for rule R1,

You can use either J-Web or the CLI configuration editor to configure the DSCP value in an IDP policy.

This topic contains:

[Contents] [Prev] [Next] [Index] [Report an Error]