Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Rate-Limiting Filter Based on Destination Class

Requirements

No special configuration beyond device initialization is required before configuring this example.

Before you begin, configure the destination class class1.

Overview

In this example, you use a stateless firewall filter to set rate limits based on a destination class.

• Create a template for the policer by including the policer policer-name statement.
• Reference the policer in a filter term that specifies the policer in the policer policer-name nonterminating action.

You can also activate a policer by including the policer (input | output) policer-template-name statement at a logical interface.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

• Configure the Stateless Firewall Filter
• Apply the Stateless Firewall Filter to a Logical Interface
• Confirm and Commit Your Candidate Configuration

CLI Quick Configuration

Configure the Stateless Firewall Filter

Step-by-Step Procedure

1. Create the stateless firewall filter rl_dclass1.

   [edit]user@host# edit firewall filter rl_dclass1

2. Configure the policer template police_class1.

   [edit firewall filter rl_dclass1]user@host# set policer police_class1 if-exceeding bandwidth-limit 25user@host# set policer police_class1 if-exceeding burst-size-limit 1000user@host# set policer police_class1 then discard

3. Configure a filter term that uses policer police_class1 to rate-limit traffic for destination class class1.

   [edit firewall filter rl_dclass1]user@host# set term term1 from destination-class class1user@host# set term term1 then policer police_class1

Apply the Stateless Firewall Filter to a Logical Interface

Step-by-Step Procedure

1. Configure the logical interface to which you will apply the stateless firewall filter.

   [edit]user@host# edit interfaces ge-0/0/1 unit 0 family inet

2. Configure the interface address for the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set address 10.1.2.3/30

3. Apply the stateless firewall filter to the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set filter input rl_dclass1

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show firewall

   filter rl_dclass1 {policer police_class1 {if-exceeding {bandwidth-limit 25;burst-size-limit 1000;}then {discard;}}term term1 {from {destination-class class1;}then {policer police_class1;}}}

2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show interfaces

   ge-0/0/1 {unit 0 {family inet {filter {input rl_dclass1;}address 10.1.2.3/30;}}}

3. If you are done configuring the device, commit your candidate configuration.

   [edit]user@host# commit

Verification

To confirm that the configuration is working properly, enter the show class-of-service ge-0/0/1 operational mode command.