- play_arrow Overview
- play_arrow Tenant Systems
- Tenant Systems Overview
- Security Zones for Tenant Systems
- Flow for Tenant Systems
- Flow Trace for Tenant Systems
- Firewall Authentication for Tenant Systems
- Security Policies for Tenant Systems
- Screen Options for Tenant Systems
- NAT for Tenant Systems
- Content Security for Tenant Systems
- IDP for Tenant Systems
- ALG for Tenant Systems
- DHCP for Tenant Systems
- Security Log for Tenant Systems
- AppQoS for Tenant Systems
- Application Security for Tenant Systems
- play_arrow Configuration Statements and Operational Commands
AppQoS for Logical Systems
Application quality of service (AppQoS) enable you to identify and control access to specific applications and provides the granularity of the stateful firewall rule base to match and enforce quality of service (QoS) at the application layer. AppQoS feature expands the capability of Junos OS class of service (CoS) for logical systems.
Application Quality of Service Support for Logical Systems Overview
The application quality of service (AppQoS) feature expands the capability of Junos OS class of service (CoS) for logical systems. This includes marking DSCP values based on Layer-7 application types, honoring application-based traffic through loss priority settings, and controlling transfer rates on egress PICs based on Layer-7 application types.
When a network experiences congestion and delay, some packets must be dropped. Junos OS CoS allows you to divide traffic into classes and offer various levels of throughput and packet loss when congestion occurs. This allows packet loss to happen according to the rules you configure.
Logical system enables you to partition a single device into multiple domains to perform security and routing functions.
Starting in Junos OS Release 19.3R1, AppQoS is supported when the SRX Series Firewall is configured with logical system. You can configure a default AppQoS rule set to manage the application- traffic-control within the logical system. AppQoS provides the ability to prioritize and meter the application traffic to provide better service to business-critical or high-priority application traffic.
AppQoS rule sets are included in the logical system to implement application-aware quality-of-service control. You can configure a rule set with rules under the application-traffic-control option, and attach the AppQoS rule set to a logical system as an application service. If the traffic matches the specified application the application-aware quality of service is applied for logical system.
For AppQoS, traffic is grouped based on rules that associate a defined forwarding class with selected applications for logical system. The match criteria for the rule includes one or more applications. When traffic from a matching application encounters the rule, the rule action sets the forwarding class, and remarks the DSCP value and loss priority to values appropriate for the application.
The AppQoS DSCP rewriter conveys a packet’s quality of
service through both the forwarding class and a loss priority. The
AppQoS rate-limiting parameters control the transmission speed and
volume for its associated queues for logical system. The default AppQoS
rule set is leveraged from one of the existing AppQoS rule sets, which
are configured under the [edit class-of-service application-traffic-control] hierarchy level.
Rate limiters are applied in rules based on the application
of the traffic for logical system. Two rate limiters are applied for
each session: client-to-server and server-to-client. This usage allows traffic in each direction to be provisioned separately.
Example: Configure Application Quality of Service for Logical Systems
This example shows how to enable application quality of service (AppQoS) within a logical system to provide prioritization and rate limiting for the traffic.
Requirements
This example uses the following hardware and software components:
An SRX Series Firewall configured with logical systems.
Junos OS Release 19.3R1 and later releases.
Before you begin:
Read the Application Quality of Service Support for Logical Systems Overview to understand how and where this procedure fits in the overall support for AppQos.
No special configuration beyond device initialization is required before configuring this feature.
Overview
In this example, you configure an AppQoS rule set and invoke AppQoS as an application service in the logical system. You configure the class of service (CoS) for logical system. The AppQoS rule sets are included in the logical system to implement application-aware quality-of-service control.
Configuration
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy
level, and then enter commit from configuration mode.
set logical-systems LSYS1 class-of-service application-traffic-control rate-limiters HTTP-BW-RL bandwidth-limit 512 set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 match application junos:HTTP set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then forwarding-class best-effort set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then dscp-code-point 001000 set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then loss-priority high set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then log set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then rate-limit server-to-client HTTP-BW-RL set logical-systems LSYS1 security policies from-zone untrust to-zone trust policy from_internet match source-address any set logical-systems LSYS1 security policies from-zone untrust to-zone trust policy from_internet match destination-address any set logical-systems LSYS1 security policies from-zone untrust to-zone trust policy from_internet match application any set logical-systems LSYS1 security policies from-zone trust to-zone trust policy p1 match dynamic-application junos:web set logical-systems LSYS1 security policies from-zone untrust to-zone trust policy from_internet then permit application-services application-traffic-control rule-set RS1
Configuring AppQoS with a Logical System
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
To configure AppQoS with a Logical System:
Configure the AppQoS real-time run information about application rate limiting of current or recent sessions for logical system LSYS1.
content_copy zoom_out_mapuser@host# set logical-systems LSYS1 class-of-service application-traffic-control rate-limiters HTTP-BW-RL bandwidth-limit 512
Configure the AppQoS rules and application match criteria for logical system LSYS1.
content_copy zoom_out_mapuser@host# set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 match application junos:HTTP
Configure the AppQoS rules and the forwarding class for logical system LSYS1.
content_copy zoom_out_mapuser@host# set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then forwarding-class best-effort
Configure the AppQoS rules and the dscp-code-point for logical system LSYS1.
content_copy zoom_out_mapuser@host# set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then dscp-code-point 001000
Configure the AppQoS rules and the loss priority for logical system LSYS1.
content_copy zoom_out_mapuser@host# set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then loss-priority high
Assign the rate limiters for rule-sets.
content_copy zoom_out_mapuser@host# set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then log user@host# set logical-systems LSYS1 class-of-service application-traffic-control rule-sets RS1 rule RL1 then rate-limit server-to-client HTTP-BW-RL
Assign the class-of-service rule set to the security policy for logical system LSYS1.
content_copy zoom_out_mapuser@host# set logical-systems LSYS1 security policies from-zone untrust to-zone trust policy from_internet match source-address any user@host# set logical-systems LSYS1 security policies from-zone untrust to-zone trust policy from_internet match destination-address any user@host# set logical-systems LSYS1 security policies from-zone untrust to-zone trust policy from_internet match application any user@host# set logical-systems LSYS1 security policies from-zone trust to-zone trust policy p1 match dynamic-application junos:web user@host# set logical-systems LSYS1 security policies from-zone untrust to-zone trust policy from_internet then permit application-services application-traffic-control rule-set RS1
Results
From configuration mode, confirm your configuration
by entering the show logical-systems LSYS1 command. If
the output does not display the intended configuration, repeat the
configuration instructions in this example to correct it.
user@host# show logical-systems LSYS1
security {
policies {
from-zone untrust to-zone trust {
policy from_internet {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
application-traffic-control {
rule-set RS1;
}
}
}
}
}
}
from-zone trust to-zone trust {
policy p1 {
match {
dynamic-application junos:web;
}
}
}
}
}
class-of-service {
application-traffic-control {
rate-limiters HTTP-BW-RL {
bandwidth-limit 512;
}
rule-sets RS1 {
rule RL1 {
match {
application junos:HTTP;
}
then {
forwarding-class best-effort;
dscp-code-point 001000;
loss-priority high;
rate-limit {
server-to-client HTTP-BW-RL;
}
log;
}
}
}
}
}
If you are done configuring the device, enter commit from configuration mode.
Verification
To confirm that the configuration is working properly, perform the below tasks:
- Verifying the class-of-service application-traffic-control counter
- Verifying the class-of-service application-traffic-control statistics rate-limiter
Verifying the class-of-service application-traffic-control counter
Purpose
Verify the class-of-service application-traffic-control counter for logical systems.
Action
To verify the configuration is working properly, enter
the show class-of-service application-traffic-control counter
logical-system LSYS1 command.
user@host>show class-of-service application-traffic-control counter logical-system LSYS1
Logical System: LSYS1
pic: 0/0
Counter type Value
Sessions processed 1
Sessions marked 0
Sessions honored 0
Sessions rate limited 0
Client-to-server flows rate limited 0
Server-to-client flows rate limited 0
Session default ruleset hit 0
Session ignored no default ruleset 0
Meaning
The output displays AppQoS DSCP marking and honoring statistics based on Layer 7 application classifiers.
Verifying the class-of-service application-traffic-control statistics rate-limiter
Purpose
Verify the class-of-service application-traffic-control statistics rate-limiter for logical systems.
Action
To verify the configuration is working properly, enter
the show class-of-service application-traffic-control statistics
rate-limiter logical-system LSYS1 command.
user@host>show class-of-service application-traffic-control statistics rate-limiter logical-system LSYS1
Logical System: LSYS1
pic: 0/0
Meaning
The output displays AppQoS real-time run information about application rate limiting of current or recent sessions.
