Copy outer IP header DSCP and ECN to inner IP header

 When you enable this feature:

• The Differentiated Services Code Point (DSCP) is copied from the outer IP header to the inner IP header type of service (ToS) field.
• Clear text packets can follow inner CoS (DSCP+ECN) rules after IPsec decryption.
• If you enable it on a VPN object, the corresponding IPsec security association (SA) is cleared and reestablished.

You can use this feature with IPv4, IPv6, and chassis cluster mode. It is disabled by default.

• To enable the feature, enter set security ipsec vpn vpn-name copy-outer-dscp
• To disable the feature, enter delete security ipsec vpn vpn-name copy-outer-dscp
• To verify whether the feature is enabled or not, enter show security ipsec security-associations detail