Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

AppQoS for Tenant Systems

Application quality of service (AppQoS) enable you to identify and control access to specific applications and provides the granularity of the stateful firewall rule base to match and enforce quality of service (QoS) at the application layer. AppQoS feature expands the capability of Junos OS class of service (CoS) for tenant systems.

Application Quality of Service for Tenant Systems Overview

The application quality of service (AppQoS) feature expands the capability of Junos OS class of service (CoS) for tenant systems. This includes marking DSCP values based on Layer-7 application types, honoring application-based traffic through loss priority settings, and controlling transfer rates on egress PICs based on Layer-7 application types.

When a network experiences congestion and delay, some packets must be dropped. Junos OS CoS allows you to divide traffic into classes and offer various levels of throughput and packet loss when congestion occurs. This allows packet loss to happen according to the rules you configure.

Tenant system enables you to partition a single device into multiple domains to perform security and routing functions.

Starting in Junos OS Release 19.3R1, AppQoS is supported when the SRX Series device is configured with tenant system. You can configure a default AppQoS rule set to manage the application- traffic-control within the tenant system. AppQoS provides the ability to prioritize and meter the application traffic to provide better service to business-critical or high-priority application traffic.

AppQoS rule sets are included in the tenant system to implement application-aware quality-of-service control. You can configure a rule set with rules under the application-traffic-control option, and attach the AppQoS rule set to a tenant system as an application service. If the traffic matches the specified application the application-aware quality of service is applied for tenant system.

For AppQoS, traffic is grouped based on rules that associate a defined forwarding class with selected applications for tenant system. The match criteria for the rule includes one or more applications. When traffic from a matching application encounters the rule, the rule action sets the forwarding class, and remarks the DSCP value and loss priority to values appropriate for the application.

The AppQoS DSCP rewriter conveys a packet’s quality of service through both the forwarding class and a loss priority. The AppQoS rate-limiting parameters control the transmission speed and volume for its associated queues for tenant system. The default AppQoS rule set is leveraged from one of the existing AppQoS rule sets, which are configured under the [edit class-of-service application-traffic-control] hierarchy level.

Rate limiters are applied in rules based on the application of the traffic for tenant system. Two rate limiters are applied for each session: client-to-server and server-to-client. This usage allows traffic in each direction to be provisioned separately.

Example: Configure Application Quality of Service for Tenant Systems

This example shows how to enable application quality of service (AppQoS) within a tenant system to provide prioritization and rate limiting for the traffic.

Requirements

This example uses the following hardware and software components:

  • An SRX Series device configured with tenant systems.

  • Junos OS Release 19.3R1 and later releases.

Before you begin:

Overview

In this example, you configure an AppQoS rule set and invoke AppQoS as an application service in the tenant systems. You configure the class of service (CoS) for tenant systems. The AppQoS rule sets are included in the tenant systems to implement application-aware quality-of-service control.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Configuring AppQoS with a Tenant System

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To configure AppQoS for a tenant system:

  1. Configure the AppQoS real-time run information about application rate limiting of current or recent sessions for tenant system TSYS1.

  2. Configure the AppQoS rules and application match criteria for tenant system TSYS1.

  3. Configure the AppQoS rules and the forwarding class for tenant system TSYS1.

  4. Configure the AppQoS rules and the dscp-code-point for tenant system TSYS1.

  5. Configure the AppQoS rules and the loss priority for tenant system TSYS1.

  6. Assign the rate limiters for rule-sets.

  7. Assign the class-of-service rule set to the security policy for tenant system TSYS1.

Results

From configuration mode, confirm your configuration by entering the show tenants TSYS1 command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the configuration is working properly, perform the below tasks:

Verifying the class-of-service application-traffic-control counter

Purpose

Verify the class-of-service application-traffic-control counter for tenant systems.

Action

To verify the configuration is working properly, enter the show class-of-service application-traffic-control counter tenant TSYS1 command.

Meaning

The output displays AppQoS DSCP marking and honoring statistics based on Layer 7 application classifiers.

Verifying the class-of-service application-traffic-control statistics rate-limiter

Purpose

Verify the class-of-service application-traffic-control statistics rate-limiter for tenant systems.

Action

To verify the configuration is working properly, enter the show class-of-service application-traffic-control statistics rate-limiter tenant TSYS1 command.

Meaning

The output displays AppQoS real-time run information about application rate limiting of current or recent sessions.