DSCP Configuration
Download
Mode fokus
Ukuran font
Feature Overview
DSCP marking on the Direct Connect gateway is a traffic classification and marking capability provided by Direct Connect. It works by configuring a traffic matching policy (five-tuple rules) on the Direct Connect gateway to mark the Differentiated Services Code Point (DSCP) value for egress traffic (that is, traffic from Tencent Cloud to an IDC/other cloud). This enables traffic classification and identification.
Marked traffic can be identified by downstream network devices (including Tencent Cloud port QoS scheduling and customer IDC-side devices) and have differentiated forwarding policies applied.
Note
DSCP marking is only effective for egress traffic (outbound traffic).
How It Works
DSCP marking on the Direct Connect gateway is implemented through the following process:
1. A traffic matching policy is defined as creating traffic classification rules based on the five-tuple (protocol type, source IP address, destination IP address, source port, destination port).
2. Gateway marking: The Direct Connect gateway automatically marks the corresponding DSCP value for matched egress traffic.
3. Downstream identification: Marked packets are transmitted over the physical dedicated line, and downstream devices can execute corresponding policies based on the DSCP value.
Core Concepts
Term | Description |
Traffic matching policy | A traffic classification rule defined based on the 5-tuple (protocol type, source IP address, destination IP address, source port, destination port), used to identify service traffic. |
DSCP | DSCP (Differentiated Services Code Point), with a value range of 0 - 63, is used to identify traffic classes. |
DSCP marking | The Direct Connect gateway marks matched packets with the specified DSCP value based on the traffic matching policy. |
Use Limits
Limit | Description |
Effective Direction | Only applies to outbound (egress) traffic. |
DSCP value range | 0 - 63. |
Mutual exclusivity of traffic matching policies | A traffic matching policy cannot be bound to both gateway DSCP marking and port QoS rate limiting simultaneously. |
Prerequisites
You have created a Direct Connect gateway, completed the dedicated tunnel setup, and established connectivity with your on-premises IDC. If you need to create one, see Create a Direct Connect Gateway.
You have been granted access to the allowlist for this feature's limited release. If you do not have this permission, you can submit a ticket to apply.
Operation Steps
Step 1: Configure a Traffic Matching Policy
A traffic matching policy is used to define the characteristics of business traffic that requires DSCP marking.
1. Log in to the VPC console.
2. Select Traffic Matching Policy in the left sidebar.
3. Click New and configure the following parameters:
Parameter | Required | Description |
Name | Yes | The name of the matching policy, which facilitates identification and management. |
Priority | Yes | Valid value range: 1 - 100. A smaller value indicates a higher priority. Each network element preferentially matches the policy with a higher priority. |
Description | No | The remarks for the matching policy. It is recommended to fill in the corresponding business purpose. |
4. Click Sure to complete the traffic matching rule creation.
5. Configure matching rules.
In the matching policy list, click the ID/Name of the target policy to go to the Matching Rules tab. Click Add Rules, enter matching conditions for the business data packets, and after filling in the following parameters, click Sure.
Parameter | Required | Description |
Protocol Type | Yes | The protocol type for capturing traffic packets. Supports TCP, UDP, and others. |
Source IP range | No | The source IP address CIDR block of data packets, for example, 10.0.0.0/24. If not specified, any source IP address is matched by default. |
Target IP range | No | The target IP address CIDR block of data packets, for example, 10.0.0.0/24. If not specified, any destination IP address is matched by default. |
Source port | No | Valid range: 1 - 65535. If not specified, any source port is matched by default. |
Destination port | No | Valid range: 1 - 65535. If not specified, any destination port is matched by default. |
DSCP | No | The inner-layer DSCP of packets, with a valid range of 0 - 63. It is used to match packets that already carry a specified DSCP. If left blank, all packets are matched. |
Remark | No | The description information of the matching rule. |
Note:
A traffic matching policy is a VPC-side resource and can be referenced in Direct Connect gateway DSCP marking and QoS flow queues.
Step 2: Configure DSCP Marking for the Direct Connect Gateway
Bind a traffic matching policy to a DSCP value through DSCP marking, enabling the Direct Connect gateway to mark matched traffic with the DSCP.
1. Log in to the Direct Connect console.
2. Select Direct Connect gateway in the left sidebar to go to the gateway details page.
3. Select the DSCP Configuration tab and click Set DSCP.
4. Configure the following parameters:
Parameter | Description |
Traffic matching policy ID | Select a created traffic matching policy instance from the drop-down list. |
Direction | Outbound by default. |
DSCP | Set the DSCP marking value for the traffic matched by this policy. The value ranges from 0 to 63. |
5. Click OK to save the configuration.
Note:
1. A single traffic matching policy cannot be bound to both gateway DSCP marking and port QoS rate limiting simultaneously. The system performs a mutual exclusion check during the binding process.
2. The same DSCP value can be set for different traffic matching policies.
Step 3: Modify and Remove DSCP Configuration
Modification: You can modify the DSCP value, and the change takes effect immediately. However, you cannot modify the associated traffic matching policy. If you need to change the associated traffic matching policy, we recommend that you create a new DSCP configuration.
Disassociation: The DSCP configuration becomes invalid immediately after disassociation.
Application Scenario Examples
Distinguishing Between Core and Non-Core Services
Financial customers transmit real-time transaction data and log collection data over dedicated lines. Traffic corresponding to the transaction system IP address segment is marked with a high DSCP value (for example, DSCP 46) through five-tuple matching, while log collection traffic is marked with a low DSCP value (for example, DSCP 10). IDC-side devices then perform differentiated forwarding based on the DSCP values.
Multi-Service Traffic Classification
An enterprise uses a single dedicated line to carry three types of services: video conferencing, ERP system, and data backup. Different DSCP markings are applied to the three traffic types at the gateway, and downstream devices perform priority scheduling based on these markings.
FAQs
How Does the IDC Side Identify Traffic After Gateway Marking?
After the gateway marks the traffic, the DSCP field in the packet IP address header is modified to the configured value. IDC-side network devices can then directly read this field to execute their local QoS policy.
Can Traffic Matching Policies Be Reused?
A traffic matching policy cannot be bound to both DSCP marking and port rate limiting simultaneously. However, it can be referenced by both DSCP marking and QoS flow queues at the same time.
Bantuan dan Dukungan
Apakah halaman ini membantu?
Anda juga dapat Menghubungi Penjualan atau Mengirimkan Tiket untuk meminta bantuan.
masukan