DSCP Marking for Local Reply Traffic on a FortiGate

[JTForti]

I have a FortiGate 201F, and was curious how FortiGate treats reply traffic to a Loopback that's been tagged when it hits the FortiGate.

If I have a packet coming into the FortiGate destined to a Loopback, tagged as EF for example, it seems as if the reply traffic is being set to Default, when I think it should be sent back as EF. I'm curious if this is expected behavior or if I need to configure a specific policy to allow this to happen. 

I couldn't really find anything about how this traffic is treated on a FortiGate by default.

[HarshChavda]

Hello @JTForti ,

In a FortiGate firewall, the treatment of reply traffic depends on various factors such as policies, configurations, and the type of traffic. By default, the FortiGate should maintain the DSCP value of the incoming packet in the reply packet, unless there is a specific policy or configuration that alters this behavior.  Make sure you have a policy that explicitly allows reply traffic and maintains the DSCP value. You can configure this in the policy settings. If you have a traffic shaping policy applied, make sure it is configured to maintain the DSCP tags. Ensure that the FortiGate is configured to trust the DSCP value of incoming packets. Some configurations might reset this to default.

[JTForti]

Thanks for the information. I just have two questions if you don't mind.  How do I make sure a specific policy "allows" reply traffic to maintain the DSCP value, and how to do I make sure the FortiGate will trust the DSCP value of incoming packets?

[spoojary]

You can ensure that the FortiGate trusts the incoming DSCP value by not altering it in your policies and shapers. If you don’t have a specific policy that matches and alters the DSCP value, then FortiGate should, by default, trust the incoming DSCP value. 

You can maintain the DSCP value of the reply traffic by using reverse traffic shapers. The key here is the traffic-shper-reverse setting in the firewall policy.

If you have a traffic shaper profile that’s configured to set a specific DSCP value for forward traffic, you can also use this profile in reverse to ensure the reply traffic maintains the same DSCP value:

[Toshi_Esumi]

I'm not so sure about the reverse direction for "local-in" traffic. Since there is no option to configure diffserv-forward/-reverse in a local-in-policy. They're available only for regular firewall policies, which don't apply to any packets destined to the FGT itself.

Toshi