Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Three-Color Logical Interface (Aggregate) Policer

Requirements

Before you begin, make sure that the logical interface to which you apply the three-color logical interface policer is hosted on a Gigabit Ethernet interface (ge-) or a 10-Gigabit Ethernet interface (xe-) on an MX Series router.

Overview

• Nonconforming traffic that does not exceed the bandwidth and burst-size limits for peak traffic is categorized as yellow.
• Nonconforming traffic that exceeds the bandwidth and burst-size limits for peak traffic is categorized as red.

A logical interface policer defines traffic rate-limiting rules that you can apply to multiple protocol families on the same logical interface without creating multiple instances of the policer.

Note: You apply a logical interface policer directly to a logical interface at the logical unit level, and not by referencing the policer in a stateless firewall filter and then applying the filter to the logical interface at the protocol family level.

Topology

In this example, you configure the two-rate three-color policer trTCM2-cb as a color-blind logical interface policer and apply the policer to incoming Layer 2 traffic on logical interface ge-1/3/1.0.

Note: When using a three-color policer to rate-limit Layer 2 traffic, color-aware policing can be applied to egress traffic only.

The policer defines guaranteed traffic rate limits such that traffic that conforms to the bandwidth limit of 40 Mbps with a 100 KB allowance for traffic bursting (based on the token-bucket formula) is categorized as green. As with any policed traffic, the packets in a green flow are implicitly set to a low loss priority and then transmitted.

Nonconforming traffic that falls within the peak traffic limits of a 60 Mbps bandwidth limit and a 200 KB allowance for traffic bursting (based on the token-bucket formula) is categorized as yellow. The packets in a yellow traffic flow are implicitly set to a medium-high loss priority and then transmitted.

Nonconforming traffic that exceeds the peak traffic limits are categorized as red. The packets in a red traffic flow are implicitly set to a high loss priority. In this example, the optional policer action for red traffic (loss-priority high then discard) is configured, so packets in a red traffic flow are discarded instead of transmitted.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Configuring the Logical Interfaces
• Configuring the Two-Rate Three-Color Policer as a Logical Interface Policer
• Applying the Three-Color Policer to the Layer 2 Input at the Logical Interface

CLI Quick Configuration

Configuring the Logical Interfaces

Step-by-Step Procedure

1. Enable configuration of the interface.

   [edit]user@host# edit interfaces ge-1/3/1

2. Configure single tagging.

   [edit interfaces ge-1/3/1]user@host# set vlan-tagging

3. Configure logical interface ge-1/3/1.0.

   [edit interfaces ge-1/3/1]user@host# set unit 0 vlan-id 100user@host# set unit 0 family inet address 10.10.10.1/30

4. Configure logical interface ge-1/3/1.0.

   [edit interfaces ge-1/3/1]user@host# set unit 1 vlan-id 101user@host# set unit 1 family inet address 20.20.20.1/30 arp 20.20.20.2 mac 00:00:11:22:33:44

Results

Configuring the Two-Rate Three-Color Policer as a Logical Interface Policer

Step-by-Step Procedure

1. Enable configuration of a three-color policer.

   [edit]user@host# edit firewall three-color-policer trTCM2-cb

2. Specify that the policer is a logical interface (aggregate) policer.

   [edit firewall three-color-policer trTCM2-cb]user@host# set logical-interface-policer
   A logical interface policer rate-limits traffic based on a percentage of the media rate of the physical interface underlying the logical interface to which the policer is applied, and the policer is applied directly to the interface rather than referenced by a firewall filter.

3. Specify that the policer is two-rate and color-blind.

   [edit firewall three-color-policer trTCM2-cb]user@host# set two-rate color-blind
   A color-aware three-color policer takes into account any coloring markings that might have been set for a packet by another traffic policer configured at a previous network node, and any preexisting color markings are used in determining the appropriate policing action for the packet.

   Because you are applying this three-color policer applied to input at Layer 2, you must configure the policer to be color-blind.

4. Specify the policer traffic limits used to classify a green traffic flow.

   [edit firewall three-color-policer trTCM2-cb]user@host# set two-rate committed-information-rate 40muser@host# set two-rate committed-burst-size 100k

5. Specify the additional policer traffic limits used to classify a yellow or red traffic flow.

   [edit firewall three-color-policer trTCM2-cb]user@host# set two-rate peak-information-rate 60muser@host# set two-rate peak-burst-size 200k

6. (Optional) Specify the configured policer action for packets in a red traffic flow.

   [edit firewall three-color-policer trTCM2-cb]user@host# set action loss-priority high then discard
   In color-aware mode, the three-color policer configured action can increase the packet loss priority (PLP) level of a packet, but never decrease it. For example, if a color-aware three-color policer meters a packet with a medium PLP marking, it can raise the PLP level to high, but cannot reduce the PLP level to low.

Results

Applying the Three-Color Policer to the Layer 2 Input at the Logical Interface

Step-by-Step Procedure

1. Enable application of Layer 2 logical interface policers.

   [edit]user@host# edit interfaces ge-1/3/1 unit 0

2. Apply the three-color logical interface policer to a logical interface input.

   [edit interfaces ge-1/3/1 unit 0]user@host# set layer2-policerinput-three-color trTCM2-cb

Results

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

• Displaying Traffic Statistics and Policers for the Logical Interface
• Displaying Statistics for the Policer

Displaying Traffic Statistics and Policers for the Logical Interface

Purpose

Verify the traffic flow through the logical interface and that the policer is evaluated when packets are received on the logical interface.

Action

• Input: trTCM2-cb-ge-1/3/1.0-log_int-i
• Output: trTCM2-cb-ge-1/3/1.0-log_int-o

The log_int-i suffix denotes a logical interface policer applied to input traffic, while the log_int-o suffix denotes a logical interface policer applied to output traffic. In this example, the logical interface policer is applied to in the input direction only.

Displaying Statistics for the Policer

Purpose

Verify the number of packets evaluated by the policer.

Action

• trTCM2-cb-ge-1/3/1.0-log_int-i
• trTCM2-cb-e-1/3/1.0-log_int-o

The log_int-i suffix denotes a logical interface policer applied to input traffic, while the log_int-o suffix denotes a logical interface policer applied to output traffic. In this example, the logical interface policer is applied to input traffic only.