burst-size-limit (Policer)
Syntax
burst-size-limit bytes;
Hierarchy Level
[edit dynamic-profiles profile-name firewall policer policer-name if-exceeding], [edit firewall policer policer-name if-exceeding], [edit logical-systems logical-system-name policer policer-name if-exceeding]
Description
For a single-rate two-color policer, configure the burst size as a number of bytes. The burst size allows for short periods of traffic bursting (back-to-back traffic at average rates that exceed the configured bandwidth limit). Single-rate two-color policing uses the single token bucket algorithm to measure traffic-flow conformance to a two-color policer rate limit.
Traffic at the interface that conforms to the bandwidth limit is categorized green. Traffic that exceeds the specified rate is also categorized
as green provided that sufficient tokens remain in the single token bucket. Packets in a green flow are implicitly marked with low packet loss
priority and then passed through the interface.
Traffic that exceeds the specified rate when insufficient tokens remain in the single token bucket is categorized red. Depending on the configuration of the two-color policer, packets in a red traffic flow might be implicitly discarded; or the packets might be re-marked with a specified forwarding class, a specified PLP, or both, and then passed through the interface.
The burst size extends the function of the bandwidth limit (configured using either the bandwidth-limit bps statement
or the bandwidth-percent percentage statement) to allow bursts of traffic up to a limit based on the overall traffic
load:
When a single-rate two-color policer is applied to the input or output traffic at an interface, the initial capacity for traffic bursting is equal to the number of bytes specified by this statement.
During periods of relatively low traffic (traffic that arrives at or departs from the interface at overall rates below the token arrival rate), unused tokens accumulate in the bucket, but only up to the configured token bucket depth.
Single-rate two-color policing allows bursts of traffic for short periods, whereas single-rate and two-rate three-color policing allows more sustained bursts of traffic.
Hierarchical policing is a form of two-color policing that applies different policing actions based on whether the packets are classified for expedited forwarding (EF) or for a lower priority. You apply a hierarchical policer to ingress Layer 2 traffic to allows bursts of EF traffic for short period and bursts of non-EF traffic for short periods, with EF traffic always taking precedence over non-EF traffic.
The burst-size limit enforced is based on the burst-size limit you configure. For a rate-limited logical interface, the Packet Forwarding Engine calculates the optimum burst-size-limit values and then applies the value closest to the burst-size-limit value specified in the policer configuration.
On MX Series routers and EX Series switches, the burst-size limit is not as freely configurable as it is on other platforms. Junos OS does not support
an unlimited combination of policer bandwidth and burst-size limits on MX Series routers and EX Series switches. For a single-rate two-color policer on an
MX Series router and on an EX Series switch, the minimum supported burst-size limit is equivalent to the amount of traffic allowed by the policer bandwidth
limit in a time span of 1 millisecond. For example, for a policer configured with a bandwidth-limit value of 1 Gbps, the minimum supported
value for burst-size-limit on an MX Series router is 125 KB. If you configure a value that is smaller than the minimum, Junos OS overrides
the configuration and applies the actual minimum.
Options
bytes—Burst-size limit in bytes. The minimum recommended value is the maximum transmission unit (MTU) of the IP
packets being policed. You can specify the value either as a complete decimal number or as a decimal number followed by the abbreviation k (1000), m (1,000,000),
or g (1,000,000,000).
Range: 1500 through 100,000,000,000
Default: None
Required Privilege Level
firewall—To view this statement in the configuration.firewall-control—To add this statement to the configuration.
Release Information
Statement introduced before Junos OS Release 7.4.
Support at the [edit dynamic-profiles ... if-exceeding] hierarchy level introduced in Junos OS Release 11.4.