Working example is set-tos needed

[aagrafi]

Hello,

I need a working example of setting two firewall shaping-policies to match DSCP EF and AF43 respectively. I don't understand how to use the commands set tos-mask and set tos as explained in CLI ref. for 6.2 (the examples and the documentation is pure crap IMHO). I'm thinking of using set tos-mask 0xc0 and set tos 0xb8 for EF and set tos 0x98. Do you think this is correct or should I use different values?

Thanks

Andreas

[Toshi_Esumi]

That setting is for DSCP based priority queuing you can see under

diag sys traffic-priority list

 However, if didn't change the global setting to DSCP, it's setting priority based on TOS values.

xxx-fg1 # diag sys traffic-priority list
Traffic priority type is set to TOS.
00:medium 01:medium 02:medium 03:medium 04:medium 05:medium 06:medium 07:medium
08:medium 09:medium 10:medium 11:medium 12:medium 13:medium 14:medium 15:medium

 And if incoming packets are marked with DSCP, not TOS, I'm not sure how they would be queued. To avoid the confusion/complexity, I would recommend you change the setting to use DSCP. Probably it wouldn't change the problem you're concerning about now though.

Toshi

[Pkoum1]

I am using shaping profiles (type queueing) with max, guaranteed bw and priorities. Profiles are consisted of shaping policies that should match dscp marked packets using tos/tos mask. I'm not using any other criteria here. Profiles are applied on interfaces using "set egress-shaping-profile".

Whlie using cmd "diagnose netlink intf-class list" i can see some classes matching while others don't. So, packets marked with af31 match the policy with a tos of 0x68 and mask 0xfc which increments counter "Sent packets" using the above cmd. Packets marked EF with tos 0xb8 and mask 0xfc do not increment the above counter.

Im thinking on reverting this from dscp matching to plain source destination port match which seems to work although all tests are not conducted in a congestive state.

PS.  Global setting is on DSCP values 

[Toshi_Esumi]

I wouldn't be able to speak of anything with shaping profiles. When we examined traffic-shaping with FortiOS 5.4, probably about 5-6 years ago, the profiles didn't work with VPN (site-to-site) w/ or w/o split-tunneling. So we exclusively use shaping-policies.

I heard interface base shaping works more reliably now but I don't know if any limitations still exist.

Toshi

[Pkoum1]

You are right. I am on 6.4 and by the looks of it and the TAC person, this may be a bug that seems to be triggered when the traffic matching the shaping profile is passed through a policy that has hardware acceleration on. When you disable acceleration traffic matches on shaping profile.

[martini]

I saw you mentioned you used queuing for your per int. shaping. I'm rather new to Fortigate, but is NPU offloading the same a hardware acceleration. If that is case it appears NPU offloading is not possible with WRED/queuing enabled:

Traffic shaping with queuing using a traffic shaping profile