Policer Overview
Policing, or rate limiting, enables you to limit the amount of traffic that passes into or out of an interface. It is an essential component of firewall filters that is designed to thwart denial-of-service (DoS) attacks. Networks police traffic by limiting the input or output transmission rate of a class of traffic on the basis of user-defined criteria. Policing traffic allows you to control the maximum rate of traffic sent or received on an interface and to partition a network into multiple priority levels or classes of service.
Policers require you to apply limits to the traffic flow and set a consequence for packets that exceed these limits—usually a higher loss priority—so that if packets encounter downstream congestion, they are discarded first.
Policing uses the token-bucket algorithm, which enforces a limit on average bandwidth while allowing bursts up to a specified maximum value. It offers more flexibility than the leaky bucket algorithm (see the Junos OS Class of Service Configuration Guide) in allowing a certain amount of bursty traffic before it starts discarding packets.
You can define specific classes of traffic on an interface and apply a set of rate limits to each. You can use a policer in one of two ways: as part of a filter configuration or as part of a logical interface (where the policer is applied to all traffic on that interface).
After you have defined and named a policer, it is stored as a template. You can later use the same policer name to provide the same policer configuration each time you wish to use it. This eliminates the need to define the same policer values more than once.
Juniper Networks routing platform architectures can support three types of policer:
- Single-rate two-color—A two-color policer (or “policer” when used without qualification) meters the traffic stream and classifies packets into two categories of packet loss priority (PLP) according to a configured bandwidth and burst-size limit. You can mark packets that exceed the bandwidth and burst-size limit in some way, or simply discard them. A policer is most useful for metering traffic at the port (physical interface) level.
- Single-rate three-color—This type of policer is defined in RFC 2697, A Single Rate Three Color Marker, as part of an assured forwarding (AF) per-hop-behavior (PHB) classification system for a Differentiated Services (DiffServ) environment. This type of policer meters traffic based on the configured committed information rate (CIR), committed burst size (CBS), and the excess burst size (EBS). Traffic is marked as belonging to one of three categories (green, yellow, or red) based on whether the packets arriving are below the CBS (green), exceed the CBS (yellow) but not the EBS, or exceed the EBS (red). A single-rate three-color policer is most useful when a service is structured according to packet length and not peak arrival rate.
- Two-rate three-color—This type of policer is defined in RFC 2698, A Two Rate Three Color Marker, as part of an assured forwarding (AF) per-hop-behavior (PHB) classification system for a Differentiated Services (DiffServ) environment. This type of policer meters traffic based on the configured CIR and peak information rate (PIR), along with their associated burst sizes, the CBS and peak burst size (PBS). Traffic is marked as belonging to one of three categories (green, yellow, or red) based on whether the packets arriving are below the CIR (green), exceed the CIR (yellow) but not the PIR, or exceed the PIR (red). A two-rate three-color policer is most useful when a service is structured according to arrival rates and not necessarily packet length.
Policer actions are implicit or explicit and vary by policer type. The term Implicit means that Junos assigns the loss-priority automatically. Table 1 describes the policer actions.
Table 1: Policer Actions
Policer | Marking | Implicit Action | Configurable Action |
|---|---|---|---|
Single-rate two-color | Green (Conforming) | Assign low loss priority | None |
Red (Nonconforming) | None | Assign low or high loss priority, assign a forwarding
class, or discard | |
Single-rate three-color | Green (Conforming) | Assign low loss priority | None |
Yellow (Above the CIR and CBS) | Assign medium-high loss priority | None | |
Red (Above the EBS) | Assign high loss priority | Discard | |
Two-rate three-color | Green (Conforming) | Assign low loss priority | None |
Yellow (Above the CIR and CBS) | Assign medium-high loss priority | None | |
Red (Above the PIR and PBS) | Assign high loss priority | Discard |
You can configure policers at the queue, logical interface, or Layer 2 (MAC) level. Only a single policer is applied to a packet at the egress queue, and the search for policers occurs in this order:
- Queue level
- Logical interface level
- Layer 2 (MAC) level
Three-color policers are not bound by a green-yellow-red coloring convention. Packets are marked with low, medium-high, or high PLP bit configurations based on color, so both three-color policer schemes extend the functionality of class-of-service (CoS) traffic policing by providing three levels of drop precedence (loss priority) instead of the two normally available in port-level policers. Both single-rate and two-rate three-color policer schemes can operate in two modes:
- Color-blind—In color-blind mode, the three-color policer assumes that all packets examined have not been previously marked or metered. In other words, the three-color policer is “blind” to any previous coloring a packet might have had.
- Color-aware—In color-aware mode, the three-color
policer assumes that all packets examined have been previously marked
or metered. In other words, the three-color policer is “aware”
of the previous coloring a packet might have had. In color-aware mode,
the three-color policer can increase the PLP of a packet, but never
decrease it. For example, if a color-aware three-color policer meters
a packet with a medium PLP marking, it can raise the PLP level to
high, but cannot reduce the PLP level to low.
Note: We recommend you use the naming convention policertypeTCM#-color type when configuring three-color policers and policer# when configuring two-color policers. TCM stands for three-color marker. Because policers can be numerous and must be applied correctly to work, a simple naming convention makes it easier to apply the policers properly.
For example, the first single-rate, color-aware three-color policer configured would be named srTCM1-ca. The second two-rate, color-blind three-color configured would be named trTCM2-cb.
