Multi-stage VLAN CoS marking

A FortiGate can configure the traffic shaper to dynamically change the CoS value of outgoing VLAN packets based on the shaper profile. This allows the FortiGate to mark traffic with different CoS values at different stages of the shaping process.

config firewall shaper traffic-shaper
    edit <name>
        set bandwidth-unit {kbps | mbps | gbps}
        set guaranteed-bandwidth <integer>
        set maximum-bandwidth <integer>
        set cos-marking {enable | disable}
        set cos-marking-method {static | multi-stage}
        set cos <3-bit_binary>
        set exceed-cos <3-bit_binary>
        set maximum-cos <3-bit_binary>
        set exceed-bandwidth <integer>
    next
end

cos-marking {enable | disable}	Enable/disable VLAN CoS marking (default = disable).
cos-marking-method {static | multi-stage}	Set the VLAN CoS marking method. static: use static VLAN CoS marking (default) multi-stage: multi-stage VLAN CoS marking
cos <3-bit_binary>	Set the VLAN CoS mark, 3-bit binary (000 - 111).
exceed-cos <3-bit_binary>	Set the VLAN CoS mark for traffic in guaranteed-bandwidth and exceed-bandwidth, 3-bit binary (000 - 111).
maximum-cos <3-bit_binary>	Set the VLAN CoS mark for traffic in exceed-bandwidth and maximum-bandwidth, 3-bit binary (000 - 111).
exceed-bandwidth <integer>	Set the exceed bandwidth used for DSCP or VLAN CoS multi-stage marking. The integer value range depends on the bandwidth-unit setting. This setting is only available for CoS multi-stage marking.

Example

In this example, mutli-stage VLAN CoS marking is configured using traffic shapers on FortiGate A and FortiGate B. FortiGate A applies multi-stage CoS marking with the following traffic shaper settings:

• Traffic below the guaranteed bandwidth will apply CoS 6.

• Traffic greater than the guaranteed bandwidth will apply CoS 6 and 5.

• Traffic greater than the exceed bandwidth will apply CoS 6, 5, and 4.

A traffic shaper and shaping policy are configured on FortiGate B. When traffic comes from FortiGate A with CoS 6, the traffic shaping policy will be applied because the CoS matches.

Multi-stage VLAN CoS marking is not supported on NP models. Traffic is not offloaded when it is enabled.

To configure mutli-stage VLAN CoS marking on FortiGate A:

1. Configure the firewall policy:

   config firewall policy
       edit 7
           set srcintf "port1"
           set dstintf "vlan100"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set srcaddr6 "all"
           set dstaddr6 "all"
           set schedule "always"
           set service "ALL"
           set logtraffic all
           set traffic-shaper "multi-stage-cos-fgta"
           set traffic-shaper-reverse "multi-stage-cos-fgta"
       next
   end

2. Configure the traffic shaper:

   config firewall shaper traffic-shaper
       edit "multi-stage-cos-fgta"
           set guaranteed-bandwidth 1000
           set maximum-bandwidth 4000
           set per-policy enable
           set exceed-bandwidth 2000
           set cos-marking enable
           set cos-marking-method multi-stage
           set cos 110
           set exceed-cos 101
           set maximum-cos 100
       next
   end

3. Check the session list to verify that CoS 6 is marked:

   # diagnose sys session list 
   session info: proto=17 proto_state=00 duration=6 expire=180 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=multi-stage-cos-fgta prio=2 guarantee 125000Bps max 500000Bps traffic 504900Bps drops 163905268B
   reply-shaper=multi-stage-cos-fgta prio=2 guarantee 125000Bps max 500000Bps traffic 504900Bps drops 0B
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=6/6
   state=log may_dirty npu npd os rs f00 
   statistic(bytes/packets/allow_err): org=3804176/292/1 reply=0/0/0 tuples=2
   tx speed(Bps/kbps): 583462/4667 rx speed(Bps/kbps): 0/0
   orgin->sink: org pre->post, reply pre->post dev=19->47/47->19 gwy=20.20.20.2/0.0.0.0
   hook=pre dir=org act=noop 10.1.100.11:37586->192.168.4.33:5001(0.0.0.0:0)
   hook=post dir=reply act=noop 192.168.4.33:5001->10.1.100.11:37586(0.0.0.0:0)
   src_mac=00:0c:29:57:2a:01  dst_mac=70:4c:a5:7d:d4:95
   misc=0 policy_id=7 pol_uuid_idx=1129 auth_info=0 chk_client_info=0 vd=2
   serial=0006613c tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x4000000
   npu info: flag=0x00/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0x0000/0x0000
   vlifid=0/0, vtag_in=0x0000/0x0000 in_npu=0/0, out_npu=0/0, fwd_en=0/0, qid=0/0
   no_ofld_reason:  offload-denied

To configure mutli-stage VLAN CoS marking on FortiGate B:

1. Configure the firewall policy:

   config firewall policy
       edit 4
           set srcintf "vlan100"
           set dstintf "vlan200"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set srcaddr6 "all"
           set dstaddr6 "all"
           set schedule "always"
           set service "ALL"
           set logtraffic all
       next
   end

2. Configure the traffic shaper:

   config firewall shaper traffic-shaper
       edit "multi-stage-cos-fgtb"
           set guaranteed-bandwidth 250
           set maximum-bandwidth 1000
           set per-policy enable
           set cos-marking enable
           set cos-marking-method multi-stage
           set cos 100
           set exceed-cos 101
           set maximum-cos 110
           set exceed-bandwidth 500
       next
   end

   Based on this traffic shaper, the following CoS marking rules will be applied:

   • If all traffic is less than the guaranteed bandwidth, then the traffic will be marked with CoS 4.

   • If all traffic is greater than the guaranteed bandwidth but less than the exceed bandwidth, then 50% of the traffic will be marked as CoS 4 and 50% as CoS 5.

   • If traffic is greater than the guaranteed bandwidth but less than the maximum bandwidth, then 50% of the traffic will be marked as CoS 6; CoS 4 and 5 will have another 50%.

   • If traffic is greater than the maximum bandwidth, then 50% of the traffic will be marked as CoS 6, 25% will be marked as CoS 4, and 25% will be marked as CoS 5. Packet drops will be visible in the debug output.

3. Configure the traffic shaping policy:

   config firewall shaping-policy
       edit 1
           set service "ALL"
           set srcintf "vlan100"
           set dstintf "vlan200"
           set traffic-shaper "multi-stage-cos-fgtb"
           set traffic-shaper-reverse "multi-stage-cos-fgtb"
           set class-id 2
           set cos-mask 111
           set cos 110
           set srcaddr "all"
           set dstaddr "all"
       next
   end

4. Check the session list to verify that the shaping ID (1) applied and CoS 4 is marked:

   # diagnose sys session list 
   session info: proto=1 proto_state=00 duration=1 expire=59 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=multi-stage-cos-fgtb prio=2 guarantee 31250Bps max 125000Bps traffic 236Bps drops 0B
   reply-shaper=multi-stage-cos-fgtb prio=2 guarantee 31250Bps max 125000Bps traffic 236Bps drops 0B
   per_ip_shaper=
   class_id=2 shaping_policy_id=1 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=4/4
   state=log may_dirty os rs f00 
   statistic(bytes/packets/allow_err): org=168/2/1 reply=168/2/1 tuples=2
   tx speed(Bps/kbps): 120/0 rx speed(Bps/kbps): 120/0
   orgin->sink: org pre->post, reply pre->post dev=59->61/61->59 gwy=20.20.200.3/20.20.20.1
   hook=pre dir=org act=noop 10.1.100.11:29899->192.168.4.33:8(0.0.0.0:0)
   hook=post dir=reply act=noop 192.168.4.33:29899->10.1.100.11:0(0.0.0.0:0)
   src_mac=90:6c:ac:fb:bb:97  dst_mac=04:d5:90:36:73:3f
   misc=0 policy_id=3 pol_uuid_idx=1377 auth_info=0 chk_client_info=0 vd=4
   serial=00024329 tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x040000
   no_ofld_reason:  non-npu-intf
   total session 1