What DSCP Markings are Available on the Palo Alto Networks Firewall?
Resolution
The following DSCP (Differentiated Services Code Point) markings exist on the Palo Alto Networks firewall:
af11 codepoint 001010
af12 codepoint 001100
af13 codepoint 001110
af21 codepoint 010010
af22 codepoint 010100
af23 codepoint 010110
af31 codepoint 011010
af32 codepoint 011100
af33 codepoint 011110
af41 codepoint 100010
af42 codepoint 100100
af43 codepoint 100110
cs0 codepoint 000000
cs1 codepoint 001000
cs2 codepoint 010000
cs3 codepoint 011000
cs4 codepoint 100000
cs5 codepoint 101000
cs6 codepoint 110000
cs7 codepoint 111000
ef codepoint 101110, expedited forwarding
On the web UI, the values can be configured/viewed in the Security Policy Rule. Open/add a security rule and navigate to the Other Settings section under the Actions tab:
On the CLI, the values can be viewed while configuring a security policy:
> configure
# set vsys vsys1 rulebase security rules test qos marking ip-dscp
Note: Hit the <tab> key after entering "ip-dscp" above to see the values.
owner: mbutt