CoS for Tunnels Overview
Class-of-service (CoS) information is preserved inside generic routing encapsulation (GRE) and IP-IP tunnels.
Class-of-service information is preserved inside IP Security (IPsec) tunnels. For IPsec tunnels, you do not need to configure CoS, because the ES PIC copies the type-of-service (ToS) byte from the inner IP header to the GRE or IP-IP header.
For IPsec tunnels, the IP header type-of-service (ToS) bits are copied to the outer IPsec header at encryption side of the tunnel. You can rewrite the outer ToS bits in the IPsec header using a rewrite rule. On the decryption side of the IPsec tunnel, the ToS bits in the IPsec header are not written back to the original IP header field. You can still apply a firewall filter to the ToS bits to apply a packet action on egress. For more information about IPsec and Multiservices PICs, see the Junos OS Services Interfaces Library for Routing Devices.
To configure CoS for tunnels, include the following statements at the
[edit class-of-service]
and [edit interfaces]
hierarchy level:
[edit class-of-service] interfaces { interface-name { unit logical-unit-number { rewrite-rules { dscp (rewrite-name | default); dscp-ipv6 (rewrite-name | default); exp (rewrite-name | default)protocol protocol-types; exp-push-push-push default; exp-swap-push-push default; ieee-802.1 (rewrite-name | default); inet-precedence (rewrite-name | default); } } } } rewrite-rules { (dscp | dscp-ipv6 | exp | ieee-802.1 | inet-precedence) rewrite-name { import (rewrite-name | default); forwarding-class class-name { loss-priority level code-point (alias | bits); } } } [edit interfaces] gre-interface-name { unit logical-unit-number { copy-tos-to-outer-ip-header; copy-tos-to-outer-ip-header-transit; force-control-packets-on-transit-path tunnel { traffic-class traffic-class; } } }
Tunneling and BA Classifiers
On supported platforms, BA classifiers can be used with GRE and IP-IP tunnels.
MPCs do not support BA classifiers on gr- interfaces. Use multifield classifiers instead.
When a GRE or IP-IP tunnel is configured on an incoming (core-facing) interface, the queue number and PLP information are carried through the tunnel. At the egress (customer-facing) interface, the packet is queued and the CoS bits rewritten based on the information carried through the tunnel.
If no BA classifier is configured in the incoming interface, the default classifier is applied. If no rewrite rule is configured, the default rewrite rule is applied.
For GRE and IP-IP tunnels, IP precedence and DSCP rewrite marking of the inner header do not work with more than eight forwarding classes.