Technical Tip: VLAN CoS marking with firewall policy and traffic shaping policy

Description

This article describes how to configure VLAN CoS Marking in various scenarios.

Scope

FortiOS.

Solution

To affect how network devices, such as switches, handle traffic, VLAN CoS (Class of Service) marking gives Ethernet frames inside an 802.1Q tagged frame a priority number (0–7).

VLAN CoS Marking can be configured in different ways. Here is how to configure it, referring to FortiOS v7.6.4 and the newest releases.

• Configure VLAN CoS marking in a firewall policy:

config firewall policy
    edit 1
        set vlan-cos-fwd <value>
    next
end

All traffic matching the policy will be correctly marked with CoS equal to <value>.

• Configure VLAN CoS marking in a traffic shaping policy:

config firewall shaping-policy
    edit 1
        set traffic-shaper "MARKING"
    next
end

config firewall shaper traffic-shaper
    edit "MARKING"
        set cos-marking enable
        set cos <3-bit_binary>  
    next
end

Where:

• 'set cos <3-bit_binary>' refers to the VLAN CoS bit pattern, 3-bit binary (000 - 111). 

All traffic matching the traffic shaping policy will be marked with CoS equal to <3-bit_binary>.

As explained in the documentation, VLAN CoS matching on a traffic shaping policy, anything defined in the firewall shaping-policy takes precedence over anything configured in the firewall policy if a specific session matches both the firewall policy and the firewall shaping-policy.

However, it is important to understand that firewall shaping-policy overrides firewall policy configuration, even if CoS is not enabled in the shaper. If traffic matches a traffic shaping policy, even if CoS is not configured in it, CoS marking will not work.

This is true when traffic is offloaded. If traffic matches the firewall policy, it is not offloaded; firewall shaping policy does not override firewall policy configuration if CoS is not enabled in the shaper.

The following is an example (for disabling offloading, consider this documentation Technical Tip: FortiGate Disable Hardware Acceleration):

config firewall policy
    edit 1
        set auto-asic-offload disable
        set vlan-cos-fwd 5

        set traffic-shaper "MARKING"
    next
end 

config firewall shaper traffic-shaper
    edit "MARKING"
        set cos-marking disable
    next
end

In this case, traffic will be marked with CoS equal to 5, according to the firewall policy.

• Configure VLAN CoS marking in IPSec tunnel:

For all traffic passing through an IPsec tunnel with offloading enabled, VLAN CoS marking will fail.

The 'vlan-cos-fwd' setting in firewall policy does not work when IPsec offloading is enabled.

As workaround, disabling tunnel offloading allows CoS marking to work.