Trying to wrap my head around the best way to apply traffic shaping rules to tag/enforce DSCP ZOOM traffic via MR access points. We are applying DSCP tags from ZOOM so my assumption is that I need to enforce those on the SSIDs which we have done below. But because zoom uses 443/80 and I choose the ports as definitions it tags all 443/80 with DSCP7 which I am not sure I want.
On the edge we are prioritizing traffic based on those tags and destination IPs (long list of ZOOM/Teans CIDRS) so this works because all wireless traffic over the ports below are prioritized through the network to the FW. FW then decides what to prioritize based on our QOS policies.
Teams seems easier as we are using specific UDP ranges whereas ZOOM uses http/https ports which can turn into a problem. Is there a better way to do this to only tag ZOOM specific traffic using definitions?
I have no MX, I have PAN firewalls at the office.
At home, outside of my network and sans Meraki I get the correct tags via my ZOOM client installed via the MSI file. I want the same behavior in the office but again something is not translating. Sometimes clients get all CS7 (56) and sometimes they get none at all. All of them share the same wireless/core/firewall which is prioritizing traffic, but why some get tagged with 1 tag and others get no tags is the problem I am having. And since this is only deployed on our wireless I am looking at the APs as part of the problem.
But traffic that is tagged is being influenced and given priority, I can see that.
ZOOM admin console:
Packet capture from my home office, so the only influence here is ZOOM sending DSCP tags 56 and 40 to my client and vice versa so I know ZOOM can tag its traffic correctly on both windows and OSX.
What I don't fully understand is the correlation of ZOOM sending tags and Meraki honoring them if seen, adding them if not seen and or stripping them?
Yeah so that is from my house, so the only rules applying there are ZOOM marking them which it is doing. In the office doing a packet capture from the firewall for wireless clients I don't see any tags or I see all (CS7) 56 which is just odd. So I figured Meraki must be doing something nefarious because on the backbone we are just trusting the tags and prioritizing traffic based on them.
Below is from the firewall for a wireless client at the office and all their traffic towards the internet. You can see all this users traffic is tagged as CS7 and we see the complete opposite from other users with 0 tags whatsoever.
I wanted to be sure that if Meraki does see those tags it doesn't limit bandwidth to them. So that is where the traffic shaping rules came into play and how to best ensure we had them configured correctly. When checking all the moving parts we are seeing odd behavior and not sure what is causing it.
Make a long story short we are tagging traffic from ZOOM and we aren't seeing those tags applied correctly to wireless clients. We know those clients can send/receive those tags because we see them outside the office, why inside the office we don't see the same behavior is the unknown.
Do you know if I specify a localsubnet on a rule will Meraki tag all packets on that subnet that match the ports I have defined on that same rule? Its just not clear on what exactly those definitions are doing.
Let me see if I can decipher what wired office clients are doing.
These are the default rules you are referring to? If so have you had good results using them? I can set ZOOM to use whatever I want and can go as far as to match those default rules.
Update to all this, it seems OSX clients won't tag ZOOM traffic over a Meraki SSID, but the AP will tag that traffic once it sees it. I assume this is due to fast lane on OSX but I really don't have any way to confirm that. Can you disable fast lane via Meraki?
At the end of the day we have it working mostly for what we want and these are the traffic shaping rules we ended up with. We see the tags from the client or the wired side of the AP if the client isn't tagging it.
