Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TechLibrary
Navigation

Example: Configuring Hierarchical Policers as Filter Actions

This example shows how to configure a hierarchical policer and apply the policer to ingress Layer 3 traffic at a logical interface on the MX-series platform.

Requirements

Before you begin, be sure that your environment meets the following requirements:

  • Supported on MX Series routers.

Overview

In this example, you configure a hierarchical policer as a filter action.

Configuration

Example: Hierarchical Policer as Filter Action

Step-by-Step Procedure

You can have hierarchical policers as one type of filter action. To configure a firewall filter:

  1. Configure the family address type for a firewall filter:

    [edit firewall]user@host# set family inet

  2. Specify the filter name:

    [edit firewall family inet]user@host# set filter inet-filter

  3. Specify the term name:

    [edit firewall family inet filter inet-filter]user@host# set term t1

  4. In each firewall filter term, specify the match conditions to use to match components of a packet:

    [edit firewall family inet filter inet-filter term t1]user@host# set from precedence critical-ecp immediate priorityuser@host# set from protocol tcp

  5. In each firewall filter term, specify the actions to take if the packet matches all the condition in that term:

    [edit firewall family inet filter inet-filter term t1]user@host# set then hierarchical-policer HP1

  6. (Optional) Enable all hierarchical policers in one filter to share the same policer instance in PFE:

    [edit firewall family inet filter inet-filter term t1]user@host# set then hierarchical-policer HP1 filter-specific

Results

Confirm the configuration by entering the show firewall configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

[edit]user@host# show firewall
family inet {filter inet-filter {interface-specific;term t1 {from {precedence [ critical-ecp immediate priority ];protocol tcp;}then hierarchical-policer HP1;}term t2 {from {precedence [ internet-control routine ];protocol tcp;}then hierarchical-policer HP2;}}}
family inet6 {filter inet6-filter {interface-specific;term t1 {from {next-header [ tcp udp ];forwarding-class [ assured-forwarding expedited-forwarding ];}then hierarchical-policer HP1;}term t2 {from {next-header [ tcp udp icmpv6 ospf rsvp ];forwarding-class [ network-control best-effort ];}then hierarchical-policer HP2;}}}
}

Example: Defining the Interface:

Step-by-Step Procedure

To define the interface:

  1. Enable configuration of the physical interface:

    [edit]user@host# edit interfaces ge-1/2/0 unit 0

  2. Configure the family address:

    [edit interfaces ge-1/2/0 unit 0]user@host# set family inet address 10.100.16.2/24

  3. Specify the filter name:

    [edit interfaces ge-1/2/0 unit 0 family inet]user@host# set filter inet-filteruser@host# set address 10.100.16.2/24

Results

Confirm the configuration by entering the show interfaces configuration command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

[edit]user@host# show interfaces
interfaces {ge-1/2/0 {unit 0 {family inet {filter {input inet-filter;}address 10.100.16.2/24;}family inet6 {input-hierarchal-policer shared_HP;address 1A23:120B::7634:AD01:4D/120;}}}ge-1/2/1 {unit 0 {family inet {input-hierarchal-policer shared_HP;address 10.100.16.2/24;}}}}

Verification

Confirm that the configuration is working properly.

Displaying Packets for the Firewall

Purpose

Verify the number of packets evaluated by the policer. Premium policer counters are not supported.

Action

Use the show firewall operational mode command. The command output displays the number of packets.

[edit]user@host# show firewall
Filter: __default_bpdu_filter__

Filter: utp_4550-ge-1/0/0.100-in
Counters:
Name                                                Bytes              Packets
c_ef-ge-1/0/0.0-i                                 1696750                15425
c_other-ge-1/0/0.0-i                                    0                    0
Policers:
Name                                              Packets
hp_abc-filter-ge-1/0/0.0-i                           7509
 

Related Documentation

 

Published: 2013-02-11

Supported Platforms

 

Related Documentation

 

Published: 2013-02-11

Previous Page Next Page