Routing specific DSCP tagged packets

[gilfalko]

Hi

My situation is like this:

I have 3 WAN connections and a remote site with a single WAN connection.

I'd like to monitor the latency to the remote site using all 3 WAN links and from a single address (our Opsview server).

I know I can tag the outgoing packets using DSCP. 

My question is now, can I use 3 different tags in order to tell the Fortigate unit to route each through a different WAN connection?

Thanks

Gil

[emnoc]

Don't know of any firewall that routes via DSCP tags.  Don't even think that's an option in a router AFAIK

[gilfalko]

I actually think it does exist...

There's a TOS pattern for making PBRs.

Everything with the default of 0 gets picked up usualy.

If I change it I might get what I want...

[ede_pfau]

I don't think you'd even need to set the DSCP flag. Just use PBR with the source address as criterion (/32), in combination with the destination target address.

[gilfalko]

If I want to monitor the same address from 3 wan connections,

a regular pbr will always send me through a single connection.

[emnoc]

There's a TOS pattern for making PBRs.

That's for setting TOS bits and not for making routing decisions based on TOS.

[ede_pfau]

@gilfalko: [strike]Really? Why? IMHO the whole sense of PBR is to divert traffic to destinations or interfaces based on criteria other than the destination address: source address, TOS flag, among others.[/strike]

[strike]So why would 3 PBRs not work, looking at 3 different source addresses, sending traffic out 3 different interfaces? BTW, taking the src adress or the TOS flag state for deciding should make no difference, but the TOS thing is one additional step.[/strike]

Sorry, I've overlooked that you wanted to ping ONE target from ONE source host. Of course then the TOS flag will be the only differentiator left, assuming you do the tagging on the source host.