802.1p Tagging on VLANs

[#1]

Hello, I need to mark my Ethernet frames with 802.1p priority tag in order to manage trafic priority on the switch connected to my Fortigate 50b. This field is part of the VLAN 802.1Q standard RFC. I even can not imagine Fortinet not supporting a standard !!! Can anyone help me how to do that ? Thanks

[emnoc]

Yes you can manage COS at layer2 on most ethernet switch, but how is your switch setup? On the FGT , I' ve personally never seen it down that way or know of any way to configured this. Most, manipulate qos fields within the l3 header ( i. DSCP ) Typically for COS configuration, It must be enable for trust and on the link between FGT and switch , & it must be a 802.1q trunk and you have to have qos enable on that switch. And it' s typically between l2 devices and not always cross l2 boundaries and require a mapping for L2 to L3. As stated above, This is way most admins manipulate qos within l3 headers or by adding the appropiate DSCP field on the switchport of the attached L3 device. Do yo have a network diagram of what you have and a simple flow schematic of the classiciation design (qos) from your end node? if you find a configuration for this, please tcpdump the traffic to validate the configuration or execute the appropiate qos status commands on your switch. e.g cisco or most cisco but depends on model and code show mls qos show mls qos int gi 0/1 stat good luck

[#3]

Thanks for the answer Actually my topology is really simple : 1 Fortigate 1 Manageable Switch Both are connected. The switch is already configured with VLAN and CoS. This mean 802.1Q and 802.1p, or Layer 2 QoS if you prefer. My Switch handle perfectly well L2 QoS by marking the 802.1Q Ethernet VLAN frames. As far as I can see, Fortigate can not do that, unless somebody know how to ? Actually, I' m looking for someone who know how to mark VLAN frames with L2 priority QoS on the Fortigate. Using L3 QoS doesn' t interest me (Using L3 QoS is a beautifull gift for Pirate DoS attacks). So if anyboy had a clue about setting L2 QoS on the Fortigate, I would be gratefull. Many Thanks !!!

[emnoc]

Keep in mind the FGT is a layer3 device, so I don' t suspect it would have alot of L2 features pertaining to manipulate or use of the 802.1p portion of the 802.1q frame. The same would be true of other l3 devices that I can think of; cisco router or a SLB. As far as pirate DOS attacks, have no fear. If you want and need to deployed QoS from a DSCP standpoint, I posted in the firewall forum the menas to deploy DSCP within the fwpolicies. That would be simple todo and staight forward. Good luck

[#5]

Oh yes I fear pirate DoS attack. It is so easy to set DSCP field on compromised machines ! So the beautiful QoS L3 get stuck in seconds and a big enterprise has no more telephone... It' s quite more difficult to compromise the switch that mark 802.1p field than the machines on the subnet. Well, I don' t see what could stop a L3 device to achieve the basics of Layer 2. Since the Fortigate send out Ethernet frames and tag them with VLAN, where the hell is the difficulty to program a small function to set 3 bits within the same VLAN tag ?! This sounds deliberatly a political decision... shame on Fortinet

[emnoc]

As far as fears of DoS and via the pirating of the DSCP field, think about this; if your port is set to trust COS, what would keep me from crafting a layer2 tagged framed with the correct COS values set ( 0 thru 7 ) and sending a bunch of UDP packets , which is what VOIP voice bearer packets are to begin with, and now with the COS field set upon to be acted by the next device? You are back to the same issues/concerns that you mention in your example of the compromised host and some one forging DSCP values and the switchport set for trust of these QoS values imho You actually have the same issues from a trust relationship with QoS security, regards if you perform ; mls qos trust cos or dscp or even ip precedence . I guess it depends on how trust worthly you expect one over the other..... I guess. But bottomline, you still have a trust relationship.

[#7]

I understand your considerations. But, well, as I said before, it is much more easier for a Pirate to take control of a PC than a Switch, a router, or an IP Phone. Since as I said before I' m using VLAN. A pirate compromising a PC on a Data VLAN would have no chance to get on the Voice VLAN where Telco equipements are trusted and less exposed to piracy (IE, applications, e-mail, etc...). Of course, you could have VLAN separated trafics and use DSCP QOS. But with L3 QoS and DSCP (or IP precedence) you have a weak point at the connection between the Fortigate and the Switch where you would have to re-mark DSCP fields coming from untrusty PC in order to prevente abuse. On L2 QoS, the packets coming from PC are untrusted. Whatever comes from them is set with lower CoS (802.1p). This is automaticaly and efficiently performed by L2 equipements (switches). Processing remains at level 2. With L3 QoS you have to build Policies in order to remarks paquet' s DSCP field either for each ingress port, or for the egress port going to the firewall. More over, L3 QoS require more processing and therfore expencive devices with stronger process units and smarter processing, and finally use more power which is neither good for the planet nor for the accounting of the enterprise. The IT team as well spare time and ressources for implemeting easier CoS L2 instead of more difficult L3 QoS. One rule in engineering : KISS (Keep it stupidly simple).