A Differentiated Services Code Point (DSCP) is a packet header value that can be used to request
(for example) high priority or best effort delivery for traffic. Session-Based DSCP
Classification allows you to both honor DSCP values for incoming traffic and to mark
a session with a DSCP value as session traffic exits the firewall. This enables all
inbound and outbound traffic for a session to receive continuous QoS treatment as it
flows through your network. For example, inbound return traffic from an external
server can now be treated with the same QoS priority that the firewall initially
enforced for the outbound flow based on the DSCP value the firewall detected at the
beginning of the session. Network devices between the firewall and end user will
also then enforce the same priority for the return traffic (and any other outbound
or inbound traffic for the session).
You cannot apply DSCP code
points or QoS to SSL Forward Proxy, SSL Inbound Inspection, and
SSH Proxy traffic.
Different types of DSCP markings
indicate different levels of service:
Completing this step
enables the firewall to mark traffic with the same DSCP value that
was detected at the beginning of a session (in this example, the
firewall would mark return traffic with the DSCP AF11 value). While
configuring QoS allows you to shape traffic as it egresses the firewall,
enabling this option in a security rule allows the other network
devices intermediate to the firewall and the client to continue
to enforce priority for DSCP marked traffic.
Expedited
Forwarding (EF): Can be used to request low loss, low
latency and guaranteed bandwidth for traffic. Packets with EF codepoint
values are typically guaranteed highest priority delivery.
Assured Forwarding (AF): Can be used to provide reliable delivery for
applications. Packets with AF codepoint indicate a request for the traffic
to receive higher priority treatment than the best-effort service provides
(though packets with an EF codepoint will continue to take precedence over
those with an AF codepoint).
Class Selector (CS): Can be used to
provide backward compatibility with network devices that use the
IP precedence field to mark priority traffic.
IP Precedence (ToS): Can be used by
legacy network devices to mark priority traffic (the IP Precedence
header field was used to indicate the priority for a packet before
the introduction of the DSCP classification).
Custom Codepoint: Create a custom
codepoint to match to traffic by entering a Codepoint
Name and Binary Value.
For example, select the Assured Forwarding (AF) to ensure traffic marked
with an AF codepoint value has higher priority for reliable delivery over
applications marked to receive lower priority.Use the following steps to enable
Session-Based DSCP Classification. Start by configuring QoS based on the DSCP
marking detected at the beginning of a session. You can then continue to enable the
firewall to mark the return flow for a session with the same DSCP value used to
enforce QoS for the initial outbound flow.