Having trouble marking return traffic with DSCP...

cheeze · Tue Apr 16, 2013 7:43 pm

Heya guys. I am trying to remark return traffic with certain DSCP marks based on how it enters the router.

I did it two ways, and the first way was more effecient but it didn't mark traffic. The second way I thought would also mark traffic but it does not. The second way is less effecient but I think it stratifies traffic flows better.

So I do it three ways.

First I match and classify on DSCP inbound from the LAN. I then mark connection with a new connection inbound from LAN and outbound to the ISP interfaces. Third I packet mark the established return traffic from those ISP interfaces. Fourth I match on the traffic outbound to the LAN by packet mark and then change DSCP. For some reason though on the switch that is connected in the LAN, it doesn't see the incoming packet DSCP changes.

Here's the code...

DSCP classification from the LAN:

/ip firewall mangle
add action=mark-packet chain=prerouting comment="DSCP BE Classification - Incoming from BUILT IN ETHERNET" dscp=0 in-interface="BUILT IN ETHERNET" new-packet-mark="DSCP BE"
add action=mark-packet chain=prerouting comment="DSCP CS1 Classification - Incoming from BUILT IN ETHERNET" dscp=8 in-interface="BUILT IN ETHERNET" new-packet-mark="DSCP CS1"
add action=mark-packet chain=prerouting comment="DSCP CS2 Classification - Incoming from BUILT IN ETHERNET" dscp=16 in-interface="BUILT IN ETHERNET" new-packet-mark="DSCP CS2"
add action=mark-packet chain=prerouting comment="DSCP CS3 Classification - Incoming from BUILT IN ETHERNET" dscp=24 in-interface="BUILT IN ETHERNET" new-packet-mark="DSCP CS3"
add action=mark-packet chain=prerouting comment="DSCP CS4 Classification - Incoming from BUILT IN ETHERNET" dscp=32 in-interface="BUILT IN ETHERNET" new-packet-mark="DSCP CS4"
add action=mark-packet chain=prerouting comment="DSCP CS5 Classification - Incoming from BUILT IN ETHERNET" dscp=40 in-interface="BUILT IN ETHERNET" new-packet-mark="DSCP CS5"
add action=mark-packet chain=prerouting comment="DSCP CS6 Classification - Incoming from BUILT IN ETHERNET" dscp=48 in-interface="BUILT IN ETHERNET" new-packet-mark="DSCP CS6"
add action=mark-packet chain=prerouting comment="DSCP CS7 Classification - Incoming from BUILT IN ETHERNET" dscp=56 in-interface="BUILT IN ETHERNET" new-packet-mark="DSCP CS7"

Connection marking on traffic ingressing the LAN and outbound to ISP interfaces:

add action=mark-connection chain=forward comment="DSCP BE Connection Marking - Outgoing to Comcast" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="BE Traffic Connection Outbound" out-interface=\
    "INTEL QUAD MIDDLE TOP PORT" packet-mark="DSCP BE"
add action=mark-connection chain=forward comment="DSCP BE Connection Marking - Outgoing to Centurylink" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="BE Traffic Connection Outbound" out-interface=\
    CENTURYLINK packet-mark="DSCP BE"
add action=mark-connection chain=forward comment="DSCP CS1 Connection Marking - Outgoing to Comcast" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS1 Traffic Connection Outbound" out-interface=\
    "INTEL QUAD MIDDLE TOP PORT" packet-mark="DSCP CS1"
add action=mark-connection chain=forward comment="DSCP CS1 Connection Marking - Outgoing to Centurylink" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS1 Traffic Connection Outbound" out-interface=\
    CENTURYLINK packet-mark="DSCP CS1"
add action=mark-connection chain=forward comment="DSCP CS2 Connection Marking - Outgoing to Comcast" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS2 Traffic Connection Outbound" out-interface=\
    "INTEL QUAD MIDDLE TOP PORT" packet-mark="DSCP CS2"
add action=mark-connection chain=forward comment="DSCP CS2 Connection Marking - Outgoing to Centurylink" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS2 Traffic Connection Outbound" out-interface=\
    CENTURYLINK packet-mark="DSCP CS2"
add action=mark-connection chain=forward comment="DSCP CS3 Connection Marking - Outgoing to Comcast" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS3 Traffic Connection Outbound" out-interface=\
    "INTEL QUAD MIDDLE TOP PORT" packet-mark="DSCP CS3"
add action=mark-connection chain=forward comment="DSCP CS3 Connection Marking - Outgoing to Centurylink" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS3 Traffic Connection Outbound" out-interface=\
    CENTURYLINK packet-mark="DSCP CS3"
add action=mark-connection chain=forward comment="DSCP CS4 Connection Marking - Outgoing to Comcast" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS4 Traffic Connection Outbound" out-interface=\
    "INTEL QUAD MIDDLE TOP PORT" packet-mark="DSCP CS4"
add action=mark-connection chain=forward comment="DSCP CS4 Connection Marking - Outgoing to Centurylink" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS4 Traffic Connection Outbound" out-interface=\
    CENTURYLINK packet-mark="DSCP CS4"
add action=mark-connection chain=forward comment="DSCP CS5 Connection Marking - Outgoing to Comcast" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS5 Traffic Connection Outbound" out-interface=\
    "INTEL QUAD MIDDLE TOP PORT" packet-mark="DSCP CS5"
add action=mark-connection chain=forward comment="DSCP CS5 Connection Marking - Outgoing to Centurylink" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS5 Traffic Connection Outbound" out-interface=\
    CENTURYLINK packet-mark="DSCP CS5"
add action=mark-connection chain=forward comment="DSCP CS6 Connection Marking - Outgoing to Comcast" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS6 Traffic Connection Outbound" out-interface=\
    "INTEL QUAD MIDDLE TOP PORT" packet-mark="DSCP CS6"
add action=mark-connection chain=forward comment="DSCP CS6 Connection Marking - Outgoing to Centurylink" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS6 Traffic Connection Outbound" out-interface=\
    CENTURYLINK packet-mark="DSCP CS6"
add action=mark-connection chain=forward comment="DSCP CS7 Connection Marking - Outgoing to Comcast" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS7 Traffic Connection Outbound" out-interface=\
    "INTEL QUAD MIDDLE TOP PORT" packet-mark="DSCP CS7"
add action=mark-connection chain=forward comment="DSCP CS7 Connection Marking - Outgoing to Centurylink" connection-state=new in-interface="BUILT IN ETHERNET" new-connection-mark="CS7 Traffic Connection Outbound" out-interface=\
    CENTURYLINK packet-mark="DSCP CS7"

Return traffic coming back from the ISP interfaces as matched by the connection marks:

add action=mark-packet chain=prerouting comment="DSCP BE Packet Marking - Return traffic incoming From Comcast" connection-mark="BE Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "BE Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP BE Packet Marking - Return traffic incoming From Centurylink" connection-mark="BE Traffic Connection Outbound" in-interface=CENTURYLINK new-packet-mark="BE Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS1 Packet Marking - Return traffic incoming From Comcast" connection-mark="CS1 Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "CS1 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS1 Packet Marking - Return traffic incoming From Centurylink" connection-mark="CS1 Traffic Connection Outbound" in-interface=CENTURYLINK new-packet-mark="CS1 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS2 Packet Marking - Return traffic incoming From Comcast" connection-mark="CS2 Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "CS2 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS2 Packet Marking - Return traffic incoming From Centurylink" connection-mark="CS2 Traffic Connection Outbound" in-interface=CENTURYLINK new-packet-mark="CS3 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS3 Packet Marking - Return traffic incoming From Comcast" connection-mark="CS3 Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "CS3 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS3 Packet Marking - Return traffic incoming From Centurylink" connection-mark="CS3 Traffic Connection Outbound" in-interface=CENTURYLINK new-packet-mark="CS3 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS4 Packet Marking - Return traffic incoming From Comcast" connection-mark="CS4 Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "CS4 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS4 Packet Marking - Return traffic incoming From Centurylink" connection-mark="CS4 Traffic Connection Outbound" in-interface=CENTURYLINK new-packet-mark="CS4 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS5 Packet Marking - Return traffic incoming From Comcast" connection-mark="CS5 Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "CS5 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS5 Packet Marking - Return traffic incoming From Centurylink" connection-mark="CS5 Traffic Connection Outbound" in-interface=CENTURYLINK new-packet-mark="CS5 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS6 Packet Marking - Return traffic incoming From Comcast" connection-mark="CS6 Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "CS6 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS6 Packet Marking - Return traffic incoming From Centurylink" connection-mark="CS6 Traffic Connection Outbound" in-interface=CENTURYLINK new-packet-mark="CS6 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS7 Packet Marking - Return traffic incoming From Comcast" connection-mark="CS7 Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "CS7 Return Traffic"
add action=mark-packet chain=prerouting comment="DSCP CS7 Packet Marking - Return traffic incoming From Centurylink" connection-mark="CS7 Traffic Connection Outbound" in-interface=CENTURYLINK new-packet-mark="CS7 Return Traffic

Lastly, re-marking with DSCP based on packet marks outbound to the LAN:

add action=change-dscp chain=forward comment="DSCP BE Traffic Marking - Return BE traffic" out-interface="BUILT IN ETHERNET" packet-mark="BE Return Traffic"
add action=change-dscp chain=forward comment="DSCP CS1 Traffic Marking - Return CS1 traffic" new-dscp=8 out-interface="BUILT IN ETHERNET" packet-mark="CS1 Return Traffic"
add action=change-dscp chain=forward comment="DSCP CS2 Traffic Marking - Return CS2 traffic" new-dscp=16 out-interface="BUILT IN ETHERNET" packet-mark="CS2 Return Traffic"
add action=change-dscp chain=forward comment="DSCP CS3 Traffic Marking - Return CS3 traffic" new-dscp=24 out-interface="BUILT IN ETHERNET" packet-mark="CS3 Return Traffic"
add action=change-dscp chain=forward comment="DSCP CS4 Traffic Marking - Return CS4 traffic" new-dscp=32 out-interface="BUILT IN ETHERNET" packet-mark="CS4 Return Traffic"
add action=change-dscp chain=forward comment="DSCP CS5 Traffic Marking - Return CS5 traffic" new-dscp=40 out-interface="BUILT IN ETHERNET" packet-mark="CS5 Return Traffic"
add action=change-dscp chain=forward comment="DSCP CS6 Traffic Marking - Return CS6 traffic" new-dscp=48 out-interface="BUILT IN ETHERNET" packet-mark="CS6 Return Traffic"
add action=change-dscp chain=forward comment="DSCP CS7 Traffic Marking - Return CS7 traffic" new-dscp=56 out-interface="BUILT IN ETHERNET" packet-mark="CS7 Return Traffic"

It still doesn't produce packets as on my Cisco switch I see:

STUFF-NETWORK-CORE#show ip access-lists inbound_marking_verification
Extended IP access list inbound_marking_verification
10 permit ip any any dscp default (70 matches)
20 permit ip any any dscp cs1
30 permit ip any any dscp cs2
40 permit ip any any dscp cs3
50 permit ip any any dscp cs4
60 permit ip any any dscp cs5
70 permit ip any any dscp cs6 (1575 matches)
80 permit ip any any dscp cs7
90 permit ip any any

Config of the interface that is bound on:

STUFF-NETWORK-CORE#show run interface gigabitEthernet 1/0/1
Building configuration...

Current configuration : 756 bytes
!
interface GigabitEthernet1/0/1
 description L3 | STUFF-NETWORK-EDGE | BUILT IN ETHERNET
 no switchport
 bandwidth 100000
 ip address 192.168.0.2 255.255.255.252
 ip access-group inbound_marking_verification in
 ip pim dr-priority 4294967294
 ip pim query-interval 10
 ip pim sparse-mode
 ip ospf cost 20
 ip ospf hello-interval 1
 ip ospf dead-interval 5
 ip ospf priority 255
 load-interval 30
 speed 1000
 duplex full
 srr-queue bandwidth share 242 242 242 242
 srr-queue bandwidth shape 0 0 0 0
 ipv6 address FDFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:2/126
 ipv6 enable
 ipv6 ospf cost 20
 ipv6 ospf hello-interval 1
 ipv6 ospf dead-interval 5
 ipv6 ospf priority 255
 ipv6 ospf 1 area 0.0.0.0
 mls qos trust dscp
 hold-queue 100 in
 hold-queue 100 out
end

Am I making sense here on the marking? I THINK I am but I am not sure if the return traffic on the Mikrotik is properly being identified. Thanks yalls

Caci99 · Tue Apr 16, 2013 8:38 pm

I am not sure what you are trying to achieve there, but you are using a previously connection mark to mark an inbound traffic as in:

add action=mark-packet chain=prerouting comment="DSCP BE Packet Marking - Return traffic incoming From Comcast" connection-mark="BE Traffic Connection Outbound" in-interface="INTEL QUAD MIDDLE TOP PORT" new-packet-mark=\
    "BE Return Traffic"

Once the packets leave the router, they don't have any mark on them. Also traffic incoming does not have any mark on them.

cheeze · Tue Apr 16, 2013 8:59 pm

So, what I am intending to do is this.

If a packet comes into the router as BE, and it leaves out to ISP 1, then I want the connection that it makes under connection tracking to mark the return traffic coming back in from ISP 1 as BE.

I'm doing that across all classes.

So I was thinking to classify the traffic first from the LAN into the respective classifications. BE, CS1 - CS7. Then I thought it would be correct to say...

Match traffic that is BE, goes from internal to ISP 1, and then mark a "new" connection for the return traffic to get marked as well. Then I thought I could add a prerouting filter on the inbound of ISP 1 with an "established" flag and match the previous outbound traffic that was new as established traffic coming back in. Then I thought I could add a DSCP change to BE.

Am I thinking about the packet flow correctly?

Caci99 · Tue Apr 16, 2013 11:18 pm

Keep in mind that marks applied to connections, packets or routing inside the router, will be discarded as soon as the packet leaves the router. So, there is no way that a packet arriving to the router will carry any mark with it.
What is BE or CS1 by the way? Are these just random names you want to apply to the packets, or terms for some specific connection?

cheeze · Wed Apr 17, 2013 12:17 am

So BE and CS1 are the traffic classifications under the Diffserv QoS model.

BE = Best Effort = "It'll get there when it gets there"
CS1 = Class 1 = "A little more important than best effort"

It's essentially a Diffserv way of implementing the old school IP Precedence marks.

http://www.cisco.com/en/US/tech/tk543/t ... 49f2.shtml

So, I do know that the marks do not propagate as you said. I don't intend them to propagate. However what I wished that they did was I wished that the return traffic was matched using a "connection-mark" so that I can then tell the router to match the established return traffic and add a DSCP tag before it ingresses into the LAN.

So basically, my edge router is doing outbound QoS, and on return traffic it's also remarking the same DSCP traffic as the traffic that left. So if traffic leaves the router as CS3, when the return traffic of that stream comes back to the router as an established connection/socket that it's marked as CS3 by the same router.

Caci99 · Wed Apr 17, 2013 10:34 am

I am not familiar with how Cisco divides or classifies QOS. But if these connections have in common the DSCP value, you can use it then to mark the connections. So presuming BE traffic has a dscp=8, you can use it in the mangle process. For example:

/ip firewall mangle
add chain=prerouting in-interface=LAN dscp=8 action=mark-connection new-connection-mark=BE
add chain=prerouting in-interface=WAN dscp=8 action=mark-connection new-connection-mark=BE

Having trouble marking return traffic with DSCP...

Having trouble marking return traffic with DSCP...

Re: Having trouble marking return traffic with DSCP...

Re: Having trouble marking return traffic with DSCP...

Re: Having trouble marking return traffic with DSCP...

Re: Having trouble marking return traffic with DSCP...

Re: Having trouble marking return traffic with DSCP...

Who is online