Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Filter to Set the DSCP Bit to Zero

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you use a stateless firewall filter to match packets on DSCP bit patterns. If the DSCP is 2, the packet is classified to the best-effort forwarding class, and the DSCP is set to 0. If the DSCP is 3, the packet is classified to the best-effort forwarding class.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Configure the Stateless Firewall Filter
• Apply the Stateless Firewall Filter to a Logical Interface
• Confirm and Commit Your Candidate Configuration

CLI Quick Configuration

Configure the Stateless Firewall Filter

Step-by-Step Procedure

1. Create the stateless firewall filter.

   [edit]user@host# edit firewall filter filter1

2. Configure the first term to match a packet with a DSCP of 2, change the DSCP to 0, and classify the packet to the best-effort forwarding class.

   [edit firewall filter filter1]user@host# set term 1 from dscp 2user@host# set term 1 then forwarding-class best-effortuser@host# set term 1 then dscp 0

3. Configure the other term to match a packet with a DSCP of 3 and classify the packet to the best-effort forwarding class.

   [edit firewall filter filter1]user@host# set term 2 from dscp 3user@host# set term 2 then forwarding-class best-effort

Apply the Stateless Firewall Filter to a Logical Interface

Step-by-Step Procedure

1. Configure the logical interface to which you will apply the stateless firewall filter.

   [edit]user@host# edit interfaces ge-0/1/0 unit 0 family inet

2. Apply the stateless firewall filter to the logical interface.

   [ input filter1]user@host# set filter input filter1

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show firewall

   filter filter1 {term term1 {from {dscp 2;}then {forwarding-class best-effort;dscp 0;}}term term2 {from {dscp 3;}then {forwarding-class best-effort;}}}

2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show interfaces

   ge-0/1/0 {unit 0 {family inet {filter input filter1;}}}

3. If you are done configuring the device, commit your candidate configuration.

   [edit]user@host# commit

Verification

• show class-of-service—Displays the entire class-of-service (CoS) configuration, including system-chosen defaults.
• show class-of-service classifier type dscp—Displays only the classifiers of the DSCP for IPv4 type.