close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

Assigning Rewrite Rules on a Per-Customer Basis Using Policy Maps

date_range 16-Dec-24

This topic describes the purpose and configuration of policy maps. Policy maps enable you to assign rewrite rules on a per-customer basis.

Policy Maps Overview

Most commonly, packet marking (that is, setting rewrite rules) in Junos uses the forwarding class and loss priority determined through a behavior aggregate (BA) classifier or multifield classifier. The forwarding class and loss priority are also used to decide queuing behavior. This approach does not allow you to directly assign rewrite rules to each customer because of the limited number of combinations of forwarding class and loss priority. When a new customer is added, setting rewrite rules using this approach requires changes to the configuration on the core interfaces, which is undesirable as one mistake can affect traffic from all customers.

An alternative packet marking scheme, called policy map, enables you to define rewrite rules on a per-customer basis (that is, for each customer). The policy map makes it possible to use any packet field to identify a given flow and specify a rewrite value for that flow.

A policy map is defined at the [edit class-of-service policy-map] hierarchy level. Depending on your platform and software release, the policy map can define the following types of packet marking:

IPv4 Precedence with the following options:
- proto-ip – Mark the packet for IPv4 to IPv4 traffic.
- proto-mpls – Mark the packet for an IPv4 packet entering an MPLS tunnel.
- proto-all – Enable IP header marking.
IPv6 Precedence with the following options:
- proto-ip – Mark the packet for IPv6 to IPv6 traffic.
- proto-mpls – Mark the packet for an IPv6 packet entering an MPLS tunnel.
IPv4 DSCP with the following options:
- proto-ip – Mark the packet for IPv4 to IPv4 traffic.
- proto-mpls – Mark the packet for an IPv4 packet entering an MPLS tunnel.
- proto-all – Enable IP header marking.
IPv6 DSCP with the following options:
- proto-ip – Mark the packet for IPv6 to IPv6 traffic.
- proto-mpls – Mark the packet for an IPv6 packet entering an MPLS tunnel.
- proto-all – Enable IPv6 header marking.
MPLS EXP with the following options:
- all-label – Mark all labels.
- outer-label – Mark only the outer label.
IEEE 802.1p with the following options:
- outer – Mark only the outer VLAN header.
- outer-and-inner – Mark both the outer and inner VLAN headers.
IEEE 802.1ad with the following options:
- outer – Mark only the outer VLAN header.
- outer-and-inner – Mark both the outer and inner VLAN headers.

Note:

To enable the policy map feature:

On most devices, enable enhanced-ip, enhanced-ethernet, or enhanced-mode under [edit chassis network-services].
On PTX10002-36QDD routers, enable policy-map-marking on each egress logical interface that you want to do policy map marking. You enable policy-map-marking at the [edit class-of-service interfaces interface-name unit unit-number] hierarchy level.

Note:

Policy maps have the following configuration restrictions:

When configuring both proto-ip and proto-mpls options for inet-precedence, inet6-precedence, dscp, or dscp-ipv6, you must configure both options with the same code point or code point alias.
You cannot configure inet-precedence and dscp in the same policy map.
You cannot configure inet6-precedence and dscp-ipv6 in the same policy map.
In case of MPLS SWAP/PUSH operation, only the new labels are marked on all label-switching routers (LSRs), except the penultimate hop case where if it exposes the next label in the stack, then the exposed label is marked. Therefore, with the penultimate hop, the service label is changed.
You cannot configure ieee-802.1 and ieee-802.1ad in the same policy map.
You cannot configure both outer and outer-and-inner options for ieee-802.1 and ieee-802.1ad code points in the same policy map.
For IEEE 802.1ad with the outer-and-inner option, the discard eligibility (DE) bit is marked only for the outer VLAN header. For the inner VLAN header, only the three CoS Bits are marked.

You assign a policy map to a customer through a firewall action on an ingress or egress firewall filter (where the match conditions identify the customer). Alternatively, you can assign a policy map to an ingress interface or a routing instance. You can assign multiple policy maps to a customer, one for each of the customer’s traffic flows. Also, you can assign a single policy map to multiple customers.

A policy map is executed on a packet just before it is queued, so it overrides any other packet- marking scheme that was previously applied to the packet.

Configuring Policy Maps

To assign rewrite rules on a per-customer basis:

Configure a policy map.

content_copy zoom_out_map
[edit class-of-service policy-map policy-map-name]
user@host# set inet-precedence proto-ip code-point [alias | bits];
user@host# set inet-precedence proto-mpls code-point [alias | bits]
user@host# set inet-precedence proto-all code-point [alias | bits]
user@host# set inet6-precedence proto-ip code-point [alias | bits];
user@host# set inet6-precedence proto-mpls code-point [alias | bits]
user@host# set dscp proto-ip code-point [alias | bits]
user@host# set dscp proto-mpls code-point [alias | bits]
user@host# set dscp proto-all code-point [alias | bits]
user@host# set dscp-ipv6 proto-ip code-point [alias | bits]
user@host# set dscp-ipv6 proto-mpls code-point [alias | bits]
user@host# set dscp-ipv6 proto-all code-point [alias | bits]
user@host# set exp all-label code-point [alias | bits]
user@host# set exp outer-label code-point [alias | bits]
user@host# set ieee-802.1 outer code-point [alias | bits]
user@host# set ieee-802.1 outer-and-inner code-point [alias | bits]
user@host# set ieee-802.1ad outer code-point [alias | bits]
user@host# set ieee-802.1ad outer-and-inner code-point [alias | bits]

For example:

content_copy zoom_out_map
[edit class-of-service]
user@host# set policy-map pm1 dscp proto-ip code-point 111000
user@host# set policy-map pm1 ieee-802.1 outer code-point 001
user@host# show
policy-map {
    pm1 {
        dscp proto-ip code-point 111000;
        ieee-802.1 outer code-point 001;
    }
}

Apply the policy map.

Apply the policy map to an ingress or egress firewall filter.

content_copy zoom_out_map
[edit firewall family protocol-family-name filter filter-name]
user@host# set term term-name from match-conditions
user@host# set term term-name then policy-map policy-map-name

For example:

content_copy zoom_out_map
[edit firewall family inet filter f1]
user@host# set term t1 from address 10.2.2.0/24
user@host# set term t1 then policy-map pm1
user@host# show
term t1 {
    from {
        address {
            10.2.2.0/24;
        }
    }
    then policy-map pm1;
}

Note:

In this example, every IPv4 packet arriving from IP address 10.2.2.0/24 is assigned a DSCP value of 111000.

Alternatively, apply the policy map to a routing instance.

content_copy zoom_out_map
[edit class-of-service]
user@host# set routing-instances routing-instance-name  policy-map policy-map-name

For example:

content_copy zoom_out_map
[edit class-of-service]
user@host# set routing-instances r1 policy-map pm1
user@host# show
routing-instances {
    r1 {
        policy-map pm1;
    }
}

Note:

In this example, every IPv4 packet in routing instance r1 is assigned a DSCP value of 111000.

Alternatively, apply the policy map directly to an ingress interface.

content_copy zoom_out_map
[edit class-of-service]
user@host# set interfaces interface-name  unit logical-unit-number  policy-map policy-map-name

For example:

content_copy zoom_out_map
[edit class-of-service]
user@host# set interfaces xe-4/0/0 unit 0 policy-map pm1
user@host# show
    xe-4/0/0 {
        unit 0 {
            policy-map pm1;
        }
    }

Note:

In this example, every IPv4 packet arriving on interface xe-4/0/0 unit 0 is assigned a DSCP value of 111000.

Platform-Specific Policy Map Behavior

Use Feature Explorer to confirm platform and release support for policy maps.

Use the following table to review platform-specific behaviors for your platform:

Platform	Difference
PTX10002-36QDD	Enable `policy-map-marking` on each egress logical interface that you want to do policy map marking. You enable `policy-map-marking` at the `[edit class-of-service interfaces interface-name unit unit-number]` hierarchy level. INET-Precedence option marks both IPv4 and IPv6 packets. Due to hardware limitations, you can't create a policy map with both Layer 2 and Layer 3 packet marking types. Enabling `policy-map` action on an egress filter interface does not have any impact on rewrite values. You can also use policy maps to pass meta data between firewall filters. That is, a policy map value set in an ingress filter can be matched on in an egress filter.

Platform

Difference

PTX10002-36QDD

Enable policy-map-marking on each egress logical interface that you want to do policy map marking. You enable policy-map-marking at the [edit class-of-service interfaces interface-name unit unit-number] hierarchy level.
INET-Precedence option marks both IPv4 and IPv6 packets.
Due to hardware limitations, you can't create a policy map with both Layer 2 and Layer 3 packet marking types.
Enabling policy-map action on an egress filter interface does not have any impact on rewrite values.
You can also use policy maps to pass meta data between firewall filters. That is, a policy map value set in an ingress filter can be matched on in an egress filter.

arrow_backward PREVIOUS Example: Remarking Diffserv Code Points to 802.1P PCPs to Carry CoS Profiles Across a Service Provider’s VPLS Network

NEXT arrow_forward Host Outbound Traffic IEEE802.1p Rewrite

Class of Service User Guide (Routers and EX9200 Switches)

ON THIS PAGE

Assigning Rewrite Rules on a Per-Customer Basis Using Policy Maps

Policy Maps Overview

Configuring Policy Maps

Platform-Specific Policy Map Behavior

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Class of Service User Guide (Routers and EX9200 Switches)

ON THIS PAGE

Assigning Rewrite Rules on a Per-Customer Basis Using Policy Maps

Policy Maps Overview

Configuring Policy Maps

Platform-Specific Policy Map Behavior

Related Documentation

Stay in touch