Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Two-Color and Three-Color Physical Interface Policers

Physical Interface Policer Overview

A physical interface policer is a two-color or three-color policer that defines traffic rate limiting that you can apply to input or output traffic for all the logical interfaces and protocol families configured on a physical interface, even if the logical interfaces belong to different routing instances. This feature is useful when you want to perform aggregate policing for different protocol families and different logical interfaces on the same physical interface.

For example, suppose that a provider edge (PE) router has numerous logical interfaces, each corresponding to a different customer, configured on the same link to a customer edge (CE) device. Now suppose that a customer wants to apply one set of rate limits aggregately for certain types of traffic on a single physical interface. To accomplish this, you could apply a single physical interface policer to the physical interface, which rate-limits all the logical interfaces configured on the interface and all the routing instances to which those interfaces belong.

• [edit firewall policer policer-name]
• [edit logical-system logical-system-name firewall policer policer-name]
• [edit routing-instances routing-instance-name firewall policer policer-name]
• [edit logical-systems logical-system-name routing-instances routing-instance-name firewall policer policer-name]

• [edit firewall three-color-policer policer-name]
• [edit logical-system logical-system-name firewall three-color-policer policer-name]
• [edit routing-instances routing-instance-name firewall three-color-policer policer-name]
• [edit logical-systems logical-system-name routing-instances routing-instance-name firewall three-color-policer policer-name]

You apply a physical interface policer to Layer 3 traffic by referencing the policer from a stateless firewall filter term and then applying the filter to a logical interface. You cannot apply a physical interface to Layer 3 traffic directly to the interface configuration.

To reference a single-rate two-color policer from a stateless firewall filter term, use the policer nonterminating action. To reference a single-rate or two-rate three-color policer from a stateless firewall filter term, use the three-color-policer nonterminating action.

• You must configure the firewall filter for a specific, supported protocol family: ipv4, ipv6, mpls, vpls, or circuit cross-connect (ccc), but not for family any.
• You must configure the firewall filter as a physical interface filter by including the physical-interface-filter statement at the [edit firewall family family-name filter filter-name] hierarchy level.
• A firewall filter that is defined as a physical interface filter can reference a physical interface policer only.
• A firewall filter that is defined as a physical interface filter cannot reference a policer configured with the interface-specific statement.
• You cannot configure a firewall filter as both a physical interface filter and as a logical interface filter that also includes the interface-specific statement.

Example: Configuring a Physical Interface Policer for Aggregate Traffic at a Physical Interface

This example shows how to configure a single-rate two-color policer as a physical interface policer.

• Requirements
• Overview
• Configuration
• Verification

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

A physical interface policer specifies rate-limiting for aggregate traffic, which encompasses all protocol families and logical interfaces configured on a physical interface, even if the interfaces belong to different routing instances.

You can apply a physical interface policer to Layer 3 input or output traffic only by referencing the policer from a stateless firewall filter that is configured for specific a specific protocol family (not for family any) and configured as a physical interface filter. You configure the filter terms with match conditions that select the types of packets you want to rate-limit, and you specify the physical interface policer as the action to apply to matched packets.

Topology

The physical interface policer in this example, shared-policer-A, rate-limits to 10,000,000 bps and permits a maximum burst of traffic of 500,000 bytes. You configure the policer to discard packets in nonconforming flows, but you could instead configure the policer to re-mark nonconforming traffic with a forwarding class, a packet loss priority (PLP) level, or both.

• Packets received through TCP and with the IP precedence fields critical-ecp (0xa0), immediate (0x40), or priority (0x20)
• Packets received through TCP and with the IP precedence fields internet-control (0xc0) or routine (0x00)

You could also reference the policer from physical interface filters for other protocol families.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Configuring the Logical Interfaces on the Physical Interface
• Configuring a Physical Interface Policer
• Configuring an IPv4 Physical Interface Filter
• Applying the IPv4 Physical interface Filter to a Physical Interface

CLI Quick Configuration

Configuring the Logical Interfaces on the Physical Interface

Step-by-Step Procedure

1. Enable configuration of logical interfaces.

   [edit]user@host# edit interfaces so-1/0/0

2. Configure protocol families on logical unit 0.

   [edit interfaces so-1/0/0]user@host# set unit 0 family inet address 192.168.1.1/24user@host# set unit 0 family vpls

3. Configure protocol families on logical unit 1.

   [edit interfaces so-1/0/0]user@host# set unit 1 family mpls

Results

Configuring a Physical Interface Policer

Step-by-Step Procedure

1. Enable configuration of the two-color policer.

   [edit]user@host# edit firewall policer shared-policer-A

2. Configure the type of two-color policer.

   [edit firewall policer shared-policer-A]user@host# set physical-interface-policer

3. Configure the traffic limits and the action for packets in a nonconforming traffic flow.

   [edit firewall policer shared-policer-A]user@host# set if-exceeding bandwidth-limit 100m burst-size-limit 500kuser@host# set then discard
   For a physical interface filter, the actions you can configure for packets in a nonconforming traffic flow are to discard the packets, assign a forwarding class, assign a PLP value, or assign both a forwarding class and a PLP value.

Results

Configuring an IPv4 Physical Interface Filter

Step-by-Step Procedure

1. Configure a standard stateless firewall filter under a specific protocol family.

   [edit]user@host# edit firewall family inet filter ipv4-filter
   You cannot configure a physical interface firewall filter for family any.

2. Configure the filter as a physical interface filter so that you can apply the physical interface policer as an action.

   [edit firewall family inet filter ipv4-filter]user@host# set physical-interface-filter

3. Configure the first term to match IPv4 packets received through TCP with the IP precedence fields critical-ecp, immediate, or priority and to apply the physical interface policer as a filter action.

   [edit firewall family inet filter ipv4-filter]user@host# set term tcp-police-1 from precedence [ critical-ecp immediate priority ]user@host# set term tcp-police-1 from protocol tcpuser@host# set term tcp-police-1 then policer shared-policer-A

4. Configure the first term to match IPv4 packets received through TCP with the IP precedence fields internet-control or routine and to apply the physical interface policer as a filter action.

   [edit firewall family inet filter ipv4-filter]user@host# set term tcp-police-2 from precedence [ internet-control routine ]user@host# set term tcp-police-2 from protocol tcpuser@host# set term tcp-police-2 then policer shared-policer-A

Results

Applying the IPv4 Physical interface Filter to a Physical Interface

Step-by-Step Procedure

1. Enable configuration of IPv4 on the logical interface.

   [edit]user@host# edit interfaces so-1/0/0 unit 0 family inet

2. Apply the IPv4 physical interface filter in the input direction.

   [edit interfaces so-1/0/0 unit 0 family inet]user@host# set filter input ipv4-filter

Results

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

• Displaying the Firewall Filters Applied to an Interface
• Displaying the Number of Packets Processed by the Policer at the Logical Interface

Displaying the Firewall Filters Applied to an Interface

Purpose

Verify that the firewall filter ipv4-filter is applied to the IPv4 input traffic at logical interface so-1/0/0.0.

Action

Use the show interfaces statistics operational mode command for logical interface so-1/0/0.0, and include the detail option. In the Protocol inet section of the command output, the Input Filters field shows that the firewall filter ipv4-filter is applied in the input direction.

  Logical interface so-1/0/0.0 (Index 79) (SNMP ifIndex 510) (Generation 149)
    Flags: Hardware-Down Point-To-Point SNMP-Traps 0x4000 Encapsulation: PPP
    Protocol inet, MTU: 4470, Generation: 173, Route table: 0
      Flags: Sendbcast-pkt-to-re, Protocol-Down
      Input Filters: ipv4-filter
      Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
        Destination: 10.39/16, Local: 10.39.1.1, Broadcast: 10.39.255.255, Generation: 163

Displaying the Number of Packets Processed by the Policer at the Logical Interface

Purpose

Verify the traffic flow through the logical interface and that the policer is evaluated when packets are received on the logical interface.

Action

Use the show firewall operational mode command for the filter you applied to the logical interface.

Filter: ipv4-filter                                          
Policers:
Name                                              Packets 
shared-policer-A-tcp-police-1                       32863
shared-policer-A-tcp-police-2                        3870

The command output displays the name of policer (shared-policer-A), the name of the filter term (police-1) under which the policer action is specified, and the number of packets that matched the filter term. This is only the number of out-of-specification (out-of-spec) packet counts, not all packets policed by the policer.