Skip to main content
aousien
Explorer
February 1, 2022
Question

DSCP matching in firewall policies - migrating from Cisco to FG

  • February 1, 2022
  • 2 replies
  • 2128 views

Hello , 

I am migrating some firewalls rules from a Cisco router to a FortiGate, any hints on how to convert the rules below matching on the precedence and dscp ?

 

I found tos-mask under config firewall policy in fortigate, but what this value should be for ef and cs4 ?

 

thanks in advance , below are the commands on cisco router that I am wanting to migrate to FG

 

permit udp X.X.X.X 0.255.255.255 any precedence flash
permit udp 1X.X.X.X 0.255.255.255 any precedence flash-override
permit udp any any dscp ef
permit udp any any dscp cs4

2 replies

AlexC-FTNT
Staff
Staff
February 1, 2022
Toshi_Esumi
SuperUser
SuperUser
February 3, 2022

The KB Alex pointed you to is for "marking". For "matching", you can use tos/tos-mask with 6.2 or above.

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/159007/dscp-matching-shaping

In those exacmples, FortiGate A is "marking", and FortiGate B is "matching". The tos/tos-mask is 8bit value in HEX. So my interpretation is

EF(101110)=tos byte(10111000)=0xB8

so,

set tos 0xb8

set tos-mask 0xfc

 

If I'm wrong, somebody, please correct me.

 

Toshi

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!