Firewall > QoS Mapping
478
SonicOS Enhanced 4.0 Administrator Guide
One practical application for this behavior would be configuring an 802.1p marking rule for
traffic destined for the VPN Zone. Although 802.1p tags cannot be sent across the VPN, reply
packets coming back across the VPN can be 802.1p tagged on egress from the tunnel. This
requires that 802.1p tagging is active of the physical egress interface, and that the [Zone] >
VPN Access Rule has an 802.1p marking action other than None.
After ensuring 802.1p compatibility with your relevant network devices, and enabling 802.1p
marking on applicable SonicWALL interfaces, you can begin configuring Access Rules to
manage 802.1p tags.
Referring to the following figure, the Remote Site 1 network could have two Access Rules
configured as follows:
The first Access Rule (governing LAN>VPN) would have the following effects:
• VoIP traffic (as defined by the Service Group) from LAN Primary Subnet destined to be
sent across the VPN to Main Site Subnets would be evaluated for both DSCP and 802.1p
tags.
–
The combination of setting both DSCP and 802.1p marking actions to Map is described
in the table earlier in the “Managing QoS Marking” section on page 476.
–
Sent traffic containing only an 802.1p tag (e.g. CoS = 6) would have the VPN-bound
inner (payload) packet DSCP tagged with a value of 48. The outer (ESP) packet would
also be tagged with a value of 48.
–
Assuming returned traffic has been DSCP tagged (CoS = 48) by the SonicWALL at the
Main Site, the return traffic will be 802.1p tagged with CoS = 6 on egress.
–
Sent traffic containing only a DSCP tag (e.g. CoS = 48) would have the DSCP value
preserved on both inner and outer packets.
–
Assuming returned traffic has been DSCP tagged (CoS = 48) by the SonicWALL at the
Main Site, the return traffic will be 802.1p tagged with CoS = 6 on egress.
–
Sent traffic containing only both an 802.1p tag (e.g. CoS = 6) and a DSCP tag (e.g. CoS
= 63) would give precedence to the 802.1p tag, and would be mapped accordingly. The
VPN-bound inner (payload) packet DSCP tagged with a value of 48. The outer (ESP)
packet would also be tagged with a value of 48.
Assuming returned traffic has been DSCP tagged (CoS = 48) by the SonicWALL at the Main
Site, the return traffic will be 802.1p tagged with CoS = 6 on egress.