CoS for Tunnels Overview
For Multiservices and Services PIC, Link Services, and Tunnel PICs installed on Juniper Networks M Series Multiservice Edge Routers and T Series Core Routers with enhanced Flexible PIC Concentrators (FPCs), class-of-service (CoS) information is preserved inside generic routing encapsulation (GRE) and IP-IP tunnels.
For the ES PIC installed on M Series and T Series routers with enhanced FPCs, class-of-service information is preserved inside IP Security (IPsec) tunnels. For IPsec tunnels, you do not need to configure CoS, because the ES PIC copies the type-of-service (ToS) byte from the inner IP header to the GRE or IP-IP header.
For IPsec tunnels, the IP header type-of-service (ToS) bits are copied to the outer IPsec header at encryption side of the tunnel. You can rewrite the outer ToS bits in the IPsec header using a rewrite rule. On the decryption side of the IPsec tunnel, the ToS bits in the IPsec header are not written back to the original IP header field. You can still apply a firewall filter to the ToS bits to apply a packet action on egress. For more information about ToS bits and the Multiservices PICs, see Multiservices PIC ToS Translation. For more information about IPsec and Multiservices PICs, see the Junos OS Services Interfaces Library for Routing Devices.
To configure CoS for tunnels, include the following statements
at the [edit class-of-service] and [edit interfaces] hierarchy level:
[edit class-of-service] interfaces { interface-name { unit logical-unit-number { rewrite-rules { dscp (rewrite-name | default); dscp-ipv6 (rewrite-name | default); exp (rewrite-name | default)protocol protocol-types; exp-push-push-push default; exp-swap-push-push default; ieee-802.1 (rewrite-name | default); inet-precedence (rewrite-name | default); } } } } rewrite-rules { (dscp | dscp-ipv6 | exp | ieee-802.1 | inet-precedence) rewrite-name { import (rewrite-name | default); forwarding-class class-name { loss-priority level code-point (alias | bits); } } } [edit interfaces] gre-interface-name { unit logical-unit-number { copy-tos-to-outer-ip-header; copy-tos-to-outer-ip-header-transit; force-control-packets-on-transit-path tunnel { traffic-class traffic-class; } } }