What DSCP Markings are Available on the Palo Alto Networks Firewall?

The following DSCP (Differentiated Services Code Point) markings exist on the Palo Alto Networks firewall:

  af11     codepoint 001010

  af12     codepoint 001100

  af13     codepoint 001110

  af21     codepoint 010010

  af22     codepoint 010100

  af23     codepoint 010110

  af31     codepoint 011010

  af32     codepoint 011100

  af33     codepoint 011110

  af41     codepoint 100010

  af42     codepoint 100100

  af43     codepoint 100110

  cs0      codepoint 000000

  cs1      codepoint 001000

  cs2      codepoint 010000

  cs3      codepoint 011000

  cs4      codepoint 100000

  cs5      codepoint 101000

  cs6      codepoint 110000

  cs7      codepoint 111000

  ef         codepoint 101110, expedited forwarding

On the web UI, the values can be configured/viewed in the Security Policy Rule. Open/add a security rule and navigate to the Other Settings section under the Actions tab:

On the CLI, the values can be viewed while configuring a security policy:

> configure

# set vsys vsys1 rulebase security rules test qos marking ip-dscp

Note: Hit the <tab> key after entering "ip-dscp" above to see the values.

owner: mbutt