Class-based QoS basically allocates different types of traffic into different queues/classes, where you can also control the min/max bandwidth for each queue, and dequeues/releases packets out according to their priority (class no.).

It involves two simple steps:

1. Traffic marking
2. Traffic control (classification, prioritization, shaping)

Traffic marking

Traffic/packet marking is a process to “color” the packets so that we can identify the targeted/”interesting” traffic which we want to control. Marking can be based on source/destination network/subnets, or protocol & port numbers (application).

Traffic marking is achieved using the firewall-set command with the “mark” option, eg.

firewall-set <rule-no> mark <marking-value> access src/dst/tcp/udp/dport/sport

For example, if we want to allocate bandwidth for the entire network 172.16.1.0/24, configure the below rules to match the packets:

If we want to do QoS for http application only, configure the below rules to match the packets:

!
firewall-set 20 mark 100 access tcp dport 80 remark “user http requests”
firewall-set 21 mark 100 access tcp sport 80 remark “server http replies"
!

If we want to do QoS for http application only, configure below rules to match the packets:

!
firewall-set 20 mark 100 access tcp dport 80 remark “user http requests”
firewall-set 21 mark 100 access tcp sport 80 remark “server http replies"
!

Traffic Control (classification, prioritization, shaping)

Classification basically arranges the colored packets into respective classes. A class identifies a network (VLAN), or type/group of application, depending on the marking criterion. All traffic with the same marking values belongs to the same class, and they’re assigned to their respective queue with desired bandwidth.

Each class has a class no (queue no), which sets the priority to dequeue the traffic when they leave the mbox exit interface. The lower class no. gets a higher chance to go out (higher priority).

mbox traffic shaping suppresses traffic when the link or traffic class gets congested. Unlike traffic policing, shaping method queues excess packets in a buffer (till the buffer is full) before dropping packets. This is a less “drastic” and smoother mechanism to manage traffic, compared with policing which simply drops excess packets, and mbox hardware usually comes with abundant memory/RAM to support a bigger buffer, making it an ideal solution for applications that are sensitive to packet drops.

We use the “traffic-shape” command to apply QoS control to the mbox exit interface.

!
traffic-shape <min-link-bandwidth> <max-link-bandwidth>
 class <priority1> <min-class-bandwidth> <max-class-bandwidth> match fwmark <marking-value>
 class <priority2> <min-class-bandwidth> <max-class-bandwidth> match fwmark <marking-value>
 class <priority3> <min-class-bandwidth> <max-class-bandwidth> match fwmark <marking-value>
! 

.

Configuration prerequisites:

• Determine the subscribed bandwidth for the link (WAN link speed).
• Determine which interface to apply traffic control (typically the WAN/outbound interface and LAN interface).
• Understand business requirements (eg. define traffic flows and assign them to respective classes and apply bandwidth for each class).

Example configuration (per VLAN QoS) steps

1. Identify “interesting” traffic (as per step #1.1)
2. Apply traffic-shaping on the target interface/link
3. Set class priority and class bandwidth

Example scenario:

• 1Gbps subscribed Internet link
• VLAN103 network: 10.0.103.0/24
• VLAN104 network: 10.0.104.0/24
• Assign VLAN103 network total bandwidth = 30Mbps
• Assign VLAN104 network total bandwidth = 40Mbps

Step 1: Traffic marking, identify the interesting traffic

!
firewall-set 1031 mark 103 access src 10.0.103.0/24 remark VLAN103-UL
firewall-set 1032 mark 103 access dst 10.0.103.0/24 remark VLAN103-DL
firewall-set 1041 mark 104 access src 10.0.104.0/24 remark VLAN104-UL
firewall-set 1042 mark 104 access dst 10.0.104.0/24 remark VLAN104-DL
!

Step 2: Traffic control, on both inbound and outbound interface

!
interface eth0
description “Interface to WAN”
enable
ip address 172.16.0.6/24
traffic-shape 1000000000 1000000000
 class 103 30000000 30000000 match fwmark 103 remark “VLAN103 upload”
 class 104 40000000 40000000 match fwmark 104 remark “VLAN104 upload”
!
interface eth1
description “Interface to LAN”
enable
traffic-shape 1000000000 1000000000
 class 103 30000000 40000000 match fwmark 103 remark “VLAN103 download”
 class 104 40000000 40000000 match fwmark 104 remark “VLAN104 download”
!
interface vlan 1 103
description "Wired Network vlan103"
enable
ip address 10.0.103.1/24
!
interface vlan 1 104
description "Wired Network vlan104"
enable
ip address 10.0.104.1/24
!

.

.

Troubleshooting/Verification commands

Step1. Check if packets are marked

mbox# show firewall set-list
Chain PREROUTING (policy ACCEPT 15M packets, 14G bytes)
pkts bytes target     prot opt in     out     source               destination          
Chain INPUT (policy ACCEPT 383K packets, 94M bytes)
pkts bytes target     prot opt in     out     source               destination         
Chain FORWARD (policy ACCEPT 15M packets, 14G bytes)
pkts bytes target     prot opt in     out     source               destination         
417K  684M MARK       all  --  *      *       10.0.103.0/24          0.0.0.0/0            /* set-list 1031 */ MARK set 0x67
348K  819M MARK       all  --  *      *       0.0.0.0/0            10.0.103.0/24          /* set-list 1032 */ MARK set 0x67
454K  695M MARK       all  --  *      *       10.0.104.0/24         0.0.0.0/0            /* set-list 1041 */ MARK set 0x68
329K  693M MARK       all  --  *      *       0.0.0.0/0            10.0.104.0/24         /* set-list 1042 */ MARK set 0x68

Step2. Check if packets are matched and shaped

mbox# show interface traffic-shape