Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Hierarchical Policers

Hierarchical Policer Overview

You can use a hierarchical policer to rate-limit ingress Layer 2 traffic at a physical or logical interface and apply different policing actions based on whether the packets are classified for expedited forwarding (EF) or for a lower priority.

Hierarchical policing is supported on SONET interfaces hosted on M40e, M120, and M320 edge routers with incoming Flexible PIC Concentrators (FPCs) as SFPC and outgoing FPCs as FFPC, and on MX Series, T320, T640, and T1600 core routers with Enhanced Intelligent Queuing (IQE) PICs.

You can apply hierarchical policing to a logical interface.

• Premium policer—You configure the premium policer with traffic limits for high-priority EF traffic only: a guaranteed bandwidth and a corresponding burst-size limit. EF traffic is categorized as nonconforming when its average arrival rate exceeds the guaranteed bandwidth and its average packet size exceeds the premium burst-size limit. For a premium policer, the only configurable action for nonconforming traffic is to discard the packets.
• Aggregate policer—You configure the aggregate policer with an aggregate bandwidth (to accommodate both high-priority EF traffic up to the guaranteed bandwidth and normal-priority non-EF traffic) and a burst-size limit for non-EF traffic only. Non-EF traffic is categorized as nonconforming when its average arrival rate exceeds the amount of aggregate bandwidth not currently consumed by EF traffic and its average packet size exceeds the burst-size limit defined in the aggregate policer. For an aggregate policer, the configurable actions for nonconforming traffic are to discard the packets, assign a forwarding class, or assign a packet loss priority (PLP) level.

Note: You must configure the bandwidth limit of the premium policer at or below the bandwidth limit of the aggregate policer. If the two bandwidth limits are equal, then non-EF traffic passes through the interface unrestricted only while no EF traffic arrives at the interface.

EF traffic is guaranteed the bandwidth specified as the premium bandwidth limit, while non-EF traffic is rate-limited to the amount of aggregate bandwidth not currently consumed by the EF traffic. Non-EF traffic is rate-limited to the entire aggregate bandwidth only while no EF traffic is present.

• Premium policer with bandwidth limit set to 2 Mbps, burst-size limit set to 3000 bytes, and nonconforming action set to discard packets.
• Aggregate policer with bandwidth limit set to 10 Mbps, burst-size limit set to 3000 bytes, and nonconforming action set to discard packets.

EF traffic is guaranteed a bandwidth of 2 Mbps. Bursts of EF traffic—EF traffic that arrives at the interface at rates above 2 Mbps—can also pass through the interface provided sufficient tokens are available in the 3000-byte bucket. When no tokens are available for a burst of non-EF traffic, packets are rate-limited using policing actions for the premium policer.

Non-EF traffic is metered to a bandwidth limit that ranges between 8 Mbps and 10 Mbps, depending on the average arrival rate of the EF traffic. Bursts of non-EF traffic—non-EF traffic that arrives at the interface at rates above the current limit for non-EF traffic—also pass through the interface provided sufficient tokens are available in the 3000-byte bucket. When non-EF traffic exceeds the currently allowed bandwidth or when no tokens are available for a burst of non-EF traffic, packets are rate-limited using policing actions for the aggregate policer.

Example: Configuring a Hierarchical Policer

This example shows how to configure a hierarchical policer and apply the policer to ingress Layer 2 traffic at a logical interface on a supported platform.

• Requirements
• Overview
• Configuration
• Verification

Requirements

• The interface on which you apply the hierarchical policer is a SONET interface hosted on one of the following routing platforms:

  • M40e, M120, or M320 edge router with incoming FPCs as SFPC and outgoing FPCs as FFPC.
  • MX Series, T320, T640, or T1600 core router with Enhanced Intelligent Queuing (IQE) PICs.
• No other policer is applied to the input of the interface on which you apply the hierarchical policer.
• You are aware that, if you apply the hierarchical policer to logical interface on which an input filter is also applied, the policer is executed first.

Overview

In this example, you configure a hierarchical policer and apply the policer to ingress Layer 2 traffic at a logical interface.

Topology

You apply the policer to the SONET logical interface so-1/0/0.0, which you configure for IPv4 and VPLS traffic. When you apply the hierarchical policer to that logical interface, both IPv4 and VPLS traffic is hierarchically rate-limited.

You also configure the logical interface so-1/0/0.1 for MPLS traffic. If you choose to apply the hierarchical policer to physical interface so-1/0/0, hierarchical policing would apply to IPv4 and VPLS traffic at so-1/0/0.0 and to MPLS traffic at so-1/0/0.1.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Defining the Interfaces
• Defining the Forwarding Classes
• Configuring the Hierarchical Policer
• Applying the Hierarchical Policer to Layer 2 Ingress Traffic at a Physical or Logical Interface

CLI Quick Configuration

Defining the Interfaces

Step-by-Step Procedure

1. Enable configuration of the physical interface.

   [edit]user@host# edit interfaces so-1/0/0

2. Configure logical unit 0.

   [edit interfaces so-1/0/0]user@host# set unit 0 family inet address 192.168.1.1/24user@host# set unit 0 family vpls
   If you apply a Layer 2 policer to this logical interface, you must configure at least one protocol family.

3. Configure logical unit 1.

   [edit interfaces so-1/0/0]user@host# set unit 1 family mpls

Results

Defining the Forwarding Classes

Step-by-Step Procedure

1. Enable configuration of the forwarding classes.

   [edit]user@host# edit class-of-service forwarding-classes

2. Define the forwarding classes.

   [edit class-of-service forwarding-classes]user@host# set class fc0 queue-num 0 priority high policing-priority premiumuser@host# set class fc1 queue-num 1 priority low policing-priority normaluser@host# set class fc2 queue-num 2 priority low policing-priority normaluser@host# set class fc3 queue-num 3 priority low policing-priority normal

Results

Configuring the Hierarchical Policer

Step-by-Step Procedure

1. Enable configuration of the hierarchical policer.

   [edit]user@host# edit firewall hierarchical-policer policer1

2. Configure the aggregate policer.

   [edit firewall hierarchical-policer policer1]user@host# set aggregate if-exceeding bandwidth-limit 300m burst-size-limit 30kuser@host# set aggregate then forwarding-class fc1
   For the aggregate policer, the configurable actions for a packet in a nonconforming flow are to discard the packet, change the loss priority, or change the forwarding class.

3. Configure the premium policer.

   [edit firewall hierarchical-policer policer1]user@host# set premium if-exceeding bandwidth-limit 100m burst-size-limit 50kuser@host# set premium then discard
   The bandwidth limit for the premium policer must not be greater than that of the aggregate policer.

   For the premium policer, the only configurable action for a packet in a nonconforming traffic flow is to discard the packet.

Results

Applying the Hierarchical Policer to Layer 2 Ingress Traffic at a Physical or Logical Interface

Step-by-Step Procedure

1. Enable configuration of the logical interface.

   [edit]user@host# edit interfaces so-1/0/0 unit 0
   When you apply a policer to Layer 2 traffic at a logical interface, you must define at least one protocol family for the logical interface.

2. Apply the policer to the logical interface.

   [edit]user@host# set layer2-policer input-hierarchical-policer policer1
   Alternatively, to hierarchically rate-limit Layer 2 ingress traffic for all protocol families and for all logical interfaces configured on physical interface so-1/0/0, you could reference the policer from the physical interface configuration.

Results

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

• Displaying Traffic Statistics and Policers for the Logical Interface
• Displaying Statistics for the Policer

Displaying Traffic Statistics and Policers for the Logical Interface

Purpose

Verify the traffic flow through the logical interface and that the policer is evaluated when packets are received on the logical interface.

Action

• Input: policer1-so-1/0/0.0-inet-i
• Output: policer1-so-1/0/0.0-inet-o

In this example, the policer is applied to logical interface traffic in the input direction only.

Displaying Statistics for the Policer

Purpose

Verify the number of packets evaluated by the policer.

Action

• policer1-so-1/0/0.0-inet-i
• policer1-so-1/0/0.0-inet-o

The -inet-i suffix denotes a policer applied to IPv4 input traffic, while the -inet-o suffix denotes a policer applied to IPv4 output traffic. In this example, the policer is applied to input traffic only.